[Resolvido!]Não consigo ver o meu desktop.....

[FCT 0]

Não estou conseguindo ver o meu desktop, alguem poderia por favor me ajudar a resolver o meu problema?

[Shine 0]

Olá!

 

Será necessário analisar um log do Hijackthis para descobrir a causa do seu problema.

 

Faça o seguinte:

 

1. Baixe o programa atualizado do HijackThis.

 

Salve o programa numa pasta no C:\ (Ex: C:\HijackThis\HijackThis.exe)

 

- Abra o HijackThis, clique em Do a system scan and save a logfile

 

- Copie o log salvo na pasta HijackThis e cole-o na sua resposta para prosseguirmos.

 

Qualquer dúvida fique a vontade para perguntar.

 

Abraços!

[FCT 0]

Logfile of HijackThis v1.99.1

Scan saved at 17:53:52, on 11/8/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0011)

 

Running processes:

C:\windows\System32\smss.exe

C:\windows\system32\winlogon.exe

C:\windows\system32\services.exe

C:\windows\system32\lsass.exe

C:\windows\system32\svchost.exe

C:\windows\System32\svchost.exe

C:\windows\system32\spoolsv.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7Debug\mdm.exe

C:\windows\system32\pctspk.exe

C:\ARQUIV~1\SPEEDB~1\VideoAcceleratorEngine.exe

C:\windows\system32\taskmgr.exe

C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE

C:\windows\system32\ctfmon.exe

C:\windows\system32\wuauclt.exe

C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\HijackThis.exe

 

F2 - REG:system.ini: UserInit=C:\windows\system32\userinit.exe,C:\Windows\System32\wsaupdater.exe,

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Class - {8E89C7F7-E898-5DC5-AB81-81DC45523080} - C:\windows\bcbvy1.dll (file missing)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (file missing)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O2 - BHO: &Google Notebook - {CCCCCCD3-666F-4F81-8B69-745DE9F6D897} - C:\Arquivos de programas\Google\Google Notebook\gnotes1.0.2.19-1449761217.dll

O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Arquivos de programas\DAP\DAPIEBar.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar1.dll

O3 - Toolbar: Google Notas - {CCCCCCDB-4DDB-4703-95D4-DD2C526397BF} - C:\Arquivos de programas\Google\Google Notebook\gnotes1.0.2.19-1449761217.dll

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKLM\..\RunServices: [COM+ System Applications] lsas.exe

O4 - HKLM\..\RunServices: [9637307F] C:\WINDOWS\System32\zedipisvbvf.exe

O4 - HKLM\..\RunServices: [Microsoft Restore] scrgrd.exe

O4 - HKLM\..\RunServices: [Microsoft Update] wuamgrd.exe

O4 - HKLM\..\RunServices: [Microsoft Update Configuration] WIN32SNC.exe

O4 - HKLM\..\RunServices: [NVIDIA Video drivers] video_32D.exe

O4 - HKLM\..\RunServices: [Microsoft Update Machine] wuamgrd.exe

O4 - HKLM\..\RunServices: [Microsoft Update Mechene] Updatez.exe

O4 - HKLM\..\RunServices: [Microsoft Windows Update] wupdate.exe

O4 - HKLM\..\RunServices: [NAV Scan Service] NAVscan32.exe

O4 - HKLM\..\RunServices: [Video Process] yikbhtq.exe

O4 - HKLM\..\RunServices: [$WindowsRegKey%update] IEXPLORE.EXE

O4 - HKLM\..\RunServices: [Windows USB controler] winusb.exe

O4 - HKLM\..\RunServices: [WindowsRegKey update] winupdate.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\RunServices: [Video Process] yikbhtq.exe

O4 - HKCU\..\RunServices: [Windows USB controler] winusb.exe

O4 - HKCU\..\RunOnce: [Padrão do Windows] C:\windows\system32\regsvr32.exe /s /n /i:"/InstallVS:'','Padrão do Windows','Normal'" C:\windows\system32\themeui.dll

O8 - Extra context menu item: &Clean Traces - C:\Arquivos de programas\DAP\Privacy Package\dapcleanerie.htm

O8 - Extra context menu item: &Download with &DAP - C:\Arquivos de programas\DAP\dapextie.htm

O8 - Extra context menu item: Anotar esta página (Google Notas) - res://C:\Arquivos de programas\Google\Google Notebook\gnotes1.0.2.19-1449761217.dll/gn_menu1.html

O8 - Extra context menu item: Anotar isto (Google Notas) - res://C:\Arquivos de programas\Google\Google Notebook\gnotes1.0.2.19-1449761217.dll/gn_menu2.html

O8 - Extra context menu item: Download &all with DAP - C:\Arquivos de programas\DAP\dapextie2.htm

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~1\Office10\EXCEL.EXE/3000

O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\ARQUIV~1\ICQ\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\ARQUIV~1\ICQ\ICQ.exe

O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\ARQUIV~1\DAP\DAP.EXE

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -

O16 - DPF: {33331111-1111-1111-1111-611111193423} -

O16 - DPF: {33331111-1111-1111-1111-611111193429} -

O16 - DPF: {33331111-1111-1111-1111-615111193427} -

O16 - DPF: {33331111-1131-1111-1111-611111193428} -

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1186863458158

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1186863146670

O17 - HKLM\System\CCS\Services\Tcpip\..\{A771E86F-FDBF-47C2-8FC4-23940AAB50B1}: NameServer = 200.204.0.10 200.204.0.138

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: WgaLogon - C:\windows\

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\windows\system32\WPDShServiceObj.dll

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe

O23 - Service: COM+ System Applications (COMS) - Unknown owner - C:\WINDOWS\System32\lsas.exe" -service (file missing)

O23 - Service: Google Updater Service (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod Service - Apple Computer, Inc. - C:\Arquivos de programas\iPod\bin\iPodService.exe

O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\windows\system32\pctspk.exe

O23 - Service: VideoAcceleratorEngine - Speedbit Ltd. - C:\ARQUIV~1\SPEEDB~1\VideoAcceleratorEngine.exe

[Shine 0]

Opa! Bom dia!

 

Desculpe a demora.

Seu pc está bem infectado.

 

Irei passar os procedimentos e qualquer dúvida fique a vontade para perguntar, ok?

 

Talvez você queira imprimir essas instruções ou salvá-las em um arquivo texto para fácil acesso, pois vamos entrar em modo seguro e você não terá acesso ao seu tópico

 

>>> Vai em Executar e digite: services.msc

 

- Localize o serviço: COM+ System Applications

 

- Dê um duplo clique e escolha Desativado. Clique também em Parar.

 

1. Faça o download do Killbox, descompacte-o e execute-o.

 

- Marque a opção Delete on Reboot.

 

- Agora copie os arquivos abaixo

(selecione e clique em Editar > Copiar).

 

C:\WINDOWS\System32\video_32D.exe

C:\WINDOWS\System32\lsas.exe

C:\WINDOWS\System32\zedipisvbvf.exe

C:\Windows\System32\wsaupdater.exe

C:\Windows\System32\scrgrd.exe

C:\Windows\System32\wuamgrd.exe

C:\Windows\System32\Updatez.exe

C:\Windows\System32\wupdate.exe

C:\Windows\System32\NAVscan32.exe

C:\Windows\System32\yikbhtq.exe

C:\Windows\System32\IEXPLORE.EXE

C:\Windows\System32\winupdate.exe

C:\Windows\System32\winusb.exe

C:\windows\system32\themeui.dll

 

- Volte ao KillBox. Clique em File > Paste from clipboard. Clique no botão All Files.

 

- Clique no botão . Responda Não à pergunta.

 

2. Reinicie o PC em entre em modo seguro (pressione F8 durante a inicialização e escolha modo seguro na tela de seleção)

 

3. Abra o HijackThis e clique em Do a system scan only.

 

- Marque SOMENTE as entradas abaixo e clique

 

F2 - REG:system.ini: UserInit=C:\windows\system32\userinit.exe,C:\Windows\System32\wsaupdater.exe,

O2 - BHO: Class - {8E89C7F7-E898-5DC5-AB81-81DC45523080} - C:\windows\bcbvy1.dll (file missing)

O4 - HKLM\..\RunServices: [COM+ System Applications] lsas.exe

O4 - HKLM\..\RunServices: [9637307F] C:\WINDOWS\System32\zedipisvbvf.exe

O4 - HKLM\..\RunServices: [Microsoft Restore] scrgrd.exe

O4 - HKLM\..\RunServices: [Microsoft Update] wuamgrd.exe

O4 - HKLM\..\RunServices: [Microsoft Update Configuration] WIN32SNC.exe

O4 - HKLM\..\RunServices: [NVIDIA Video drivers] video_32D.exe

O4 - HKLM\..\RunServices: [Microsoft Update Machine] wuamgrd.exe

O4 - HKLM\..\RunServices: [Microsoft Update Mechene] Updatez.exe

O4 - HKLM\..\RunServices: [Microsoft Windows Update] wupdate.exe

O4 - HKLM\..\RunServices: [NAV Scan Service] NAVscan32.exe

O4 - HKLM\..\RunServices: [Video Process] yikbhtq.exe

O4 - HKLM\..\RunServices: [$WindowsRegKey%update] IEXPLORE.EXE

O4 - HKLM\..\RunServices: [Windows USB controler] winusb.exe

O4 - HKLM\..\RunServices: [WindowsRegKey update] winupdate.exe

O4 - HKCU\..\RunServices: [Video Process] yikbhtq.exe

O4 - HKCU\..\RunServices: [Windows USB controler] winusb.exe

O4 - HKCU\..\RunOnce: [Padrão do Windows] C:\windows\system32\regsvr32.exe /s /n /i:"/InstallVS:'','Padrão do Windows','Normal'" C:\windows\system32\themeui.dll

O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -

O16 - DPF: {33331111-1111-1111-1111-611111193423} -

O16 - DPF: {33331111-1111-1111-1111-611111193429} -

O16 - DPF: {33331111-1111-1111-1111-615111193427} -

O16 - DPF: {33331111-1131-1111-1111-611111193428} -

O23 - Service: COM+ System Applications (COMS) - Unknown owner - C:\WINDOWS\System32\lsas.exe" -service (file missing)

 

4. Abra novamente o HijackThis, clique em Open the Misc Tools Section

 

- Em Misc Tools clique em Delete an NT Service.

 

- Coloque: COMS e clique em OK

 

5. Reinicie em modo normal

 

6. Vai em Iniciar > Executar e digite: MSCONFIG.

 

- Clique em OK.

 

"Habilite" todas as entradas do guia inicializar, em seguida confirme.

 

7. Reinicie o seu computador normalmente e depois faça um novo log do HijackThis

 

- Cole o novo log na sua resposta para prosseguirmos.

 

Abraços!

[FCT 0]

Logfile of HijackThis v1.99.1

Scan saved at 19:56:20, on 18/8/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16473)

 

Running processes:

C:\windows\System32\smss.exe

C:\windows\system32\winlogon.exe

C:\windows\system32\services.exe

C:\windows\system32\lsass.exe

C:\windows\system32\svchost.exe

C:\windows\System32\svchost.exe

C:\windows\system32\spoolsv.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7Debug\mdm.exe

C:\windows\system32\pctspk.exe

C:\ARQUIV~1\SPEEDB~1\VideoAcceleratorEngine.exe

C:\windows\system32\taskmgr.exe

C:\windows\system32\wuauclt.exe

C:\windows\system32\NOTEPAD.EXE

C:\HijackThis.exe

 

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (file missing)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O2 - BHO: &Google Notebook - {CCCCCCD3-666F-4F81-8B69-745DE9F6D897} - C:\Arquivos de programas\Google\Google Notebook\gnotes1.0.2.19-1449761217.dll

O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Arquivos de programas\DAP\DAPIEBar.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar1.dll

O3 - Toolbar: Google Notas - {CCCCCCDB-4DDB-4703-95D4-DD2C526397BF} - C:\Arquivos de programas\Google\Google Notebook\gnotes1.0.2.19-1449761217.dll

O4 - HKLM\..\Run: [YouTube CrazyVideos] C:\Arquivos de programas\YoutubeCrazyVideos\YoutubeCrazyVideos.exe

O4 - HKLM\..\Run: [www.hidro.4t.com ] enbiei.exe

O4 - HKLM\..\Run: [WindowsRegKey update] winupdate.exe

O4 - HKLM\..\Run: [Windows USB controler] winusb.exe

O4 - HKLM\..\Run: [Windows Update] C:\windows\System32\halgizst.exe

O4 - HKLM\..\Run: [Windows SA] C:\Program Files\WindowsSA\omniscient.exe

O4 - HKLM\..\Run: [Windows DLL Loader] C:\WINDOWS\RUNDLL16.EXE

O4 - HKLM\..\Run: [Windows Automation] mslaugh.exe

O4 - HKLM\..\Run: [windows auto update] msblast.exe

O4 - HKLM\..\Run: [WinampAgent] C:\Arquivos de programas\Winamp\winampa.exe

O4 - HKLM\..\Run: [Video Process] yikbhtq.exe

O4 - HKLM\..\Run: [userFaultCheck] %systemroot%\system32\dumprep 0 -u

O4 - HKLM\..\Run: [TkBellExe] "C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [system Update] C:\WINDOWS\System32\ebbcqhn.exe

O4 - HKLM\..\Run: [stcinstaller] c:\installer\id53.exe

O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\System32\bridge.dll",Load

O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART

O4 - HKLM\..\Run: [NvVideoCenter] C:\windows\system32\NvVid.exe

O4 - HKLM\..\Run: [NVIDIA Video drivers] video_32D.exe

O4 - HKLM\..\Run: [NAV Scan Service] NAVscan32.exe

O4 - HKLM\..\Run: [msbb] c:\docume~1\felice~1\config~1\temp\msbb.exe

O4 - HKLM\..\Run: [Motive SmartBridge] "C:\ARQUIV~1\ASSIST~2\SMARTB~1\MotiveSB.exe" /restart

O4 - HKLM\..\Run: [Mirabilis ICQ] C:\ARQUIV~1\ICQ\ICQNet.exe

O4 - HKLM\..\Run: [Microsoft Windows Update] wupdate.exe

O4 - HKLM\..\Run: [Microsoft Windows Session Manager Subsystem] C:\windows\smss.exe

O4 - HKLM\..\Run: [Microsoft Windows Logon Process] C:\windows\winlogon.exe

O4 - HKLM\..\Run: [Microsoft Update Mechene] Updatez.exe

O4 - HKLM\..\Run: [Microsoft Update Machine] wuamgrd.exe

O4 - HKLM\..\Run: [Microsoft Update Configuration] WIN32SNC.exe

O4 - HKLM\..\Run: [Microsoft Update] wuamgrd.exe

O4 - HKLM\..\Run: [Microsoft Restore] scrgrd.exe

O4 - HKLM\..\Run: [Microsoft Inet Xp..] teekids.exe

O4 - HKLM\..\Run: [lsasss.exe] C:\WINDOWS\lsasss.exe

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [iTunesHelper] "C:\Arquivos de programas\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [idyrmx] C:\WINDOWS\idyrmx.exe

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Arquivos de programas\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [fhuoqbkf] c:\windows\system32\fhuoqbkf.exe

O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Arquivos de programas\DAP\DAP.EXE" /STARTUP

O4 - HKLM\..\Run: [Discador iG] "C:\Arquivos de programas\iGv6\Discador iG.exe" boot

O4 - HKLM\..\Run: [dfrwurw] C:\WINDOWS\System32\fhuoqbkf.exe

O4 - HKLM\..\Run: [Cryptographic Service] C:\WINDOWS\System32\gkrub.exe

O4 - HKLM\..\Run: [conscorr] C:\WINDOWS\conscorr.exe

O4 - HKLM\..\Run: [COM+ System Applications] lsas.exe

O4 - HKLM\..\Run: [cApp] C:\windows\mbsync.exe /i

O4 - HKLM\..\Run: [avserve2.exe] C:\WINDOWS\avserve2.exe

O4 - HKLM\..\Run: [AVG_CC] C:\Arquivos de programas\Grisoft\AVG6\avgcc32.exe /startup

O4 - HKLM\..\Run: [AVG7_CC] C:\ARQUIV~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [161A97D0] C:\WINDOWS\System32\zedipisvbvf.exe

O4 - HKLM\..\Run: [$WindowsRegKey%update] IEXPLORE.EXE

O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [updateMgr] "C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1

O4 - HKCU\..\Run: [TraduzU.exe] C:\ARQUIV~1\KOUNEN\TRADUZ~1\2.0p\bin\TraduzU.exe

O4 - HKCU\..\Run: [skype] "C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [googletalk] "C:\Arquivos de programas\Google\Google Talk\googletalk.exe" /autostart

O4 - HKCU\..\Run: [FreeRAM XP] "C:\Arquivos de programas\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win

O4 - HKCU\..\Run: [Discador Ubbi Free] "C:\Arquivos de programas\Discador Ubbi Free\autoupdate.exe"

O4 - HKCU\..\Run: [Discador e-Pipoca] "C:\Arquivos de programas\Discador e-Pipoca\autoupdate.exe"

O4 - HKCU\..\Run: [dark] C:\windows\xcodex.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: K-Lite2006.lnk = C:\Arquivos de programas\K-Lite2006\klrun.exe

O4 - Global Startup: Google Updater.lnk = C:\Arquivos de programas\Google\Google Updater\GoogleUpdater.exe

O4 - Global Startup: Assistente Tecnico Speedy.lnk = C:\Arquivos de programas\Assistente Tecnico Speedy\bin\matcli.exe

O4 - Global Startup: Acelerador InteligWeb.lnk = C:\Arquivos de programas\Intelig\Acelerador\acelerador.exe

O8 - Extra context menu item: &Clean Traces - C:\Arquivos de programas\DAP\Privacy Package\dapcleanerie.htm

O8 - Extra context menu item: &Download with &DAP - C:\Arquivos de programas\DAP\dapextie.htm

O8 - Extra context menu item: Anotar esta página (Google Notas) - res://C:\Arquivos de programas\Google\Google Notebook\gnotes1.0.2.19-1449761217.dll/gn_menu1.html

O8 - Extra context menu item: Anotar isto (Google Notas) - res://C:\Arquivos de programas\Google\Google Notebook\gnotes1.0.2.19-1449761217.dll/gn_menu2.html

O8 - Extra context menu item: Download &all with DAP - C:\Arquivos de programas\DAP\dapextie2.htm

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~1\Office10\EXCEL.EXE/3000

O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\ARQUIV~1\ICQ\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\ARQUIV~1\ICQ\ICQ.exe

O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\ARQUIV~1\DAP\DAP.EXE

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1186863458158

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1186863146670

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: WgaLogon - C:\windows\

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\windows\system32\WPDShServiceObj.dll

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod Service - Apple Computer, Inc. - C:\Arquivos de programas\iPod\bin\iPodService.exe

O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\windows\system32\pctspk.exe

O23 - Service: VideoAcceleratorEngine - Speedbit Ltd. - C:\ARQUIV~1\SPEEDB~1\VideoAcceleratorEngine.exe

 

 

Obrigado pela ajuda, mas o meu problema ainda não foi solucionado.....

 

Abraços......FCT

[Shine 0]

Olá!

 

1. Faça o download do F-Secure Blacklight

Salve-o na área de trabalho e execute-o. Aceite o acordo.

 

Se ele encontrar qualquer arquivo, ignore. Queremos apenas o log.

 

Ao final do scan, copie o arquivo fsb-xxxxx.log (onde xxx são números) e cole-o na sua resposta.

 

2. Faça o download SDFix

 

Salve-o em sua área de trabalho. Dê um duplo clique no SDFix.exe e a ferramenta será instalada em %SystemDrive%\SDFix (geralmente C:\SDFix)

 

Talvez você queira imprimir essas instruções ou salvá-las em um arquivo texto para fácil acesso, pois você não terá acesso ao seu tópico

 

3. Reinicie o PC em entre em modo seguro (pressione F8 durante a inicialização e escolha modo seguro na tela de seleção)

 

4. Execute o SDFix em modo seguro

1. Entre na pasta SDFix que foi instalada no seu computador e dê um duplo clique no arquivo RunThis.bat
   
2. Tecle Y para que a ferramenta inicie o processo de remoção
   
3. Quando tudo terminar, você verá um aviso dizendo para apertar qualquer tecla para continuar. Ao pressionar qualquer tecla, o computador será reiniciado automaticamente
   
4. Após reiniciar, a ferramenta ainda será executada novamente e irá terminar o seu trabalho e a palavra Finished irá aparecer. Pressione qualquer tecla.
   
5. Uma janela com o relatório do SDFix irá aparecer.
   
6. Copie e cole este relatório na sua resposta. Caso você tenha fechado a janela, uma cópia do relatório estará na pasta SDFix com o nome Report.txt
   

5. Faça um novo log do HijackThis e cole-o na sua resposta.

 

Abraços!

[FCT 0]

F-Secure Blacklight:

 

 

fsbl-20070824111504

 

08/24/07 08:15:04 [info]: BlackLight Engine 1.0.64 initialized

08/24/07 08:15:04 [info]: OS: 5.1 build 2600 (Service Pack 2)

08/24/07 08:15:06 [Note]: 7019 4

08/24/07 08:15:06 [Note]: 7005 0

08/24/07 08:15:24 [Note]: 7006 0

08/24/07 08:15:24 [Note]: 7027 1

08/24/07 08:15:24 [Note]: 7027 0

08/24/07 08:15:26 [Note]: 7026 0

08/24/07 08:15:26 [Note]: 7026 0

08/24/07 08:15:49 [Note]: FSRAW library version 1.7.1022

08/24/07 08:17:26 [Note]: 7007 0

 

 

SDFix: Version 1.100

 

Run by Felice Covone Tirich on --- 24/08/2007 at 09:00

 

Microsoft Windows XP [versÆo 5.1.2600]

 

Running From: C:\DOCUME~1\FELICE~1\Desktop\SDFix

 

Safe Mode:

Checking Services:

 

 

Restoring Windows Registry Values

Restoring Windows Default Hosts File

Restoring Missing Security Center Service

 

 

Logfile of HijackThis v1.99.1

Scan saved at 09:58:33, on 24/8/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16512)

 

Running processes:

C:\windows\System32\smss.exe

C:\windows\system32\winlogon.exe

C:\windows\system32\services.exe

C:\windows\system32\lsass.exe

C:\windows\system32\svchost.exe

C:\windows\System32\svchost.exe

C:\windows\system32\spoolsv.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7Debug\mdm.exe

C:\windows\system32\pctspk.exe

C:\ARQUIV~1\SPEEDB~1\VideoAcceleratorEngine.exe

C:\windows\system32\wscntfy.exe

C:\windows\system32\taskmgr.exe

C:\windows\system32\ctfmon.exe

C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\HijackThis.exe

 

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (file missing)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O2 - BHO: &Google Notebook - {CCCCCCD3-666F-4F81-8B69-745DE9F6D897} - C:\Arquivos de programas\Google\Google Notebook\gnotes1.0.2.19-1449761217.dll

O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Arquivos de programas\DAP\DAPIEBar.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar1.dll

O3 - Toolbar: Google Notas - {CCCCCCDB-4DDB-4703-95D4-DD2C526397BF} - C:\Arquivos de programas\Google\Google Notebook\gnotes1.0.2.19-1449761217.dll

O4 - HKLM\..\Run: [YouTube CrazyVideos] C:\Arquivos de programas\YoutubeCrazyVideos\YoutubeCrazyVideos.exe

O4 - HKLM\..\Run: [www.hidro.4t.com ] enbiei.exe

O4 - HKLM\..\Run: [Windows USB controler] winusb.exe

O4 - HKLM\..\Run: [Windows SA] C:\Program Files\WindowsSA\omniscient.exe

O4 - HKLM\..\Run: [Windows Automation] mslaugh.exe

O4 - HKLM\..\Run: [windows auto update] msblast.exe

O4 - HKLM\..\Run: [WinampAgent] C:\Arquivos de programas\Winamp\winampa.exe

O4 - HKLM\..\Run: [userFaultCheck] %systemroot%\system32\dumprep 0 -u

O4 - HKLM\..\Run: [TkBellExe] "C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [stcinstaller] c:\installer\id53.exe

O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\System32\bridge.dll",Load

O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [NvVideoCenter] C:\windows\system32\NvVid.exe

O4 - HKLM\..\Run: [NAV Scan Service] NAVscan32.exe

O4 - HKLM\..\Run: [msbb] c:\docume~1\felice~1\config~1\temp\msbb.exe

O4 - HKLM\..\Run: [Motive SmartBridge] "C:\ARQUIV~1\ASSIST~2\SMARTB~1\MotiveSB.exe" /restart

O4 - HKLM\..\Run: [Mirabilis ICQ] C:\ARQUIV~1\ICQ\ICQNet.exe

O4 - HKLM\..\Run: [Microsoft Update Mechene] Updatez.exe

O4 - HKLM\..\Run: [Microsoft Update Configuration] WIN32SNC.exe

O4 - HKLM\..\Run: [Microsoft Restore] scrgrd.exe

O4 - HKLM\..\Run: [Microsoft Inet Xp..] teekids.exe

O4 - HKLM\..\Run: [lsasss.exe] C:\WINDOWS\lsasss.exe

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [iTunesHelper] "C:\Arquivos de programas\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [idyrmx] C:\WINDOWS\idyrmx.exe

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Arquivos de programas\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [fhuoqbkf] c:\windows\system32\fhuoqbkf.exe

O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Arquivos de programas\DAP\DAP.EXE" /STARTUP

O4 - HKLM\..\Run: [Discador iG] "C:\Arquivos de programas\iGv6\Discador iG.exe" boot

O4 - HKLM\..\Run: [dfrwurw] C:\WINDOWS\System32\fhuoqbkf.exe

O4 - HKLM\..\Run: [conscorr] C:\WINDOWS\conscorr.exe

O4 - HKLM\..\Run: [COM+ System Applications] lsas.exe

O4 - HKLM\..\Run: [cApp] C:\windows\mbsync.exe /i

O4 - HKLM\..\Run: [avserve2.exe] C:\WINDOWS\avserve2.exe

O4 - HKLM\..\Run: [AVG_CC] C:\Arquivos de programas\Grisoft\AVG6\avgcc32.exe /startup

O4 - HKLM\..\Run: [AVG7_CC] C:\ARQUIV~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [161A97D0] C:\WINDOWS\System32\zedipisvbvf.exe

O4 - HKLM\..\Run: [$WindowsRegKey%update] IEXPLORE.EXE

O4 - HKLM\..\Run: [sDFix] C:\DOCUME~1\FELICE~1\Desktop\SDFix\RunThis.bat /second

O4 - HKLM\..\RunOnce: [sDFix] C:\DOCUME~1\FELICE~1\DESKTOP\SDFIX\RUNTHIS.BAT /second

O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [updateMgr] "C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1

O4 - HKCU\..\Run: [TraduzU.exe] C:\ARQUIV~1\KOUNEN\TRADUZ~1\2.0p\bin\TraduzU.exe

O4 - HKCU\..\Run: [skype] "C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [googletalk] "C:\Arquivos de programas\Google\Google Talk\googletalk.exe" /autostart

O4 - HKCU\..\Run: [FreeRAM XP] "C:\Arquivos de programas\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win

O4 - HKCU\..\Run: [Discador Ubbi Free] "C:\Arquivos de programas\Discador Ubbi Free\autoupdate.exe"

O4 - HKCU\..\Run: [Discador e-Pipoca] "C:\Arquivos de programas\Discador e-Pipoca\autoupdate.exe"

O4 - HKCU\..\Run: [dark] C:\windows\xcodex.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: K-Lite2006.lnk = C:\Arquivos de programas\K-Lite2006\klrun.exe

O4 - Global Startup: Google Updater.lnk = C:\Arquivos de programas\Google\Google Updater\GoogleUpdater.exe

O4 - Global Startup: Assistente Tecnico Speedy.lnk = C:\Arquivos de programas\Assistente Tecnico Speedy\bin\matcli.exe

O4 - Global Startup: Acelerador InteligWeb.lnk = C:\Arquivos de programas\Intelig\Acelerador\acelerador.exe

O8 - Extra context menu item: &Clean Traces - C:\Arquivos de programas\DAP\Privacy Package\dapcleanerie.htm

O8 - Extra context menu item: &Download with &DAP - C:\Arquivos de programas\DAP\dapextie.htm

O8 - Extra context menu item: Anotar esta página (Google Notas) - res://C:\Arquivos de programas\Google\Google Notebook\gnotes1.0.2.19-1449761217.dll/gn_menu1.html

O8 - Extra context menu item: Anotar isto (Google Notas) - res://C:\Arquivos de programas\Google\Google Notebook\gnotes1.0.2.19-1449761217.dll/gn_menu2.html

O8 - Extra context menu item: Download &all with DAP - C:\Arquivos de programas\DAP\dapextie2.htm

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~1\Office10\EXCEL.EXE/3000

O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\ARQUIV~1\ICQ\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\ARQUIV~1\ICQ\ICQ.exe

O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\ARQUIV~1\DAP\DAP.EXE

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1186863458158

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1186863146670

O17 - HKLM\System\CCS\Services\Tcpip\..\{A771E86F-FDBF-47C2-8FC4-23940AAB50B1}: NameServer = 200.204.0.10 200.204.0.138

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: WgaLogon - C:\windows\

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\windows\system32\WPDShServiceObj.dll

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod Service - Apple Computer, Inc. - C:\Arquivos de programas\iPod\bin\iPodService.exe

O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\windows\system32\pctspk.exe

O23 - Service: VideoAcceleratorEngine - Speedbit Ltd. - C:\ARQUIV~1\SPEEDB~1\VideoAcceleratorEngine.exe

 

 

Infelizmente, o problema ainda não foi resolvido......

 

Abçs, FCT

[Shine 0]

Oi, FCT!

 

Realmente seu computador está bem infectado.

 

Vamos dar prosseguimento e qualquer dúvida fique a vontade para perguntar, ok?

 

ATF-Cleaner

Killbox, descompacte para um pasta com o nome qualquer e deixe na sua area de trabalho para ter fácil acesso.

 

1. Vai em Iniciar > Painel de Controle > Adicionar/Remover Programas e desinstale:

 

WindowsSA

 

2. Execute o Killbox

 

- Marque a opção Delete on Reboot.

 

- Agora copie os arquivos abaixo

(selecione e clique em Editar > Copiar).

 

C:\windows\system32\enbiei.exe

C:\windows\system32\winusb.exe

C:\windows\system32\mslaugh.exe

C:\windows\system32\msblast.exe

c:\installer\id53.exe

C:\windows\system32\NvVid.exe

C:\windows\system32\NAVscan32.exe

c:\docume~1\felice~1\config~1\temp\msbb.exe

C:\windows\system32\Updatez.exe

C:\windows\system32\WIN32SNC.exe

C:\windows\system32\scrgrd.exe

C:\windows\system32\teekids.exe

C:\WINDOWS\lsasss.exe

C:\WINDOWS\idyrmx.exe

c:\windows\system32\fhuoqbkf.exe

C:\WINDOWS\conscorr.exe

C:\windows\system32\lsas.exe

C:\windows\system32\mbsync.exe

C:\windows\system32\avserve2.exe

C:\WINDOWS\System32\zedipisvbvf.exe

C:\WINDOWS\System32\IEXPLORE.EXE

C:\windows\xcodex.exe

C:\WINDOWS\System32\bridge.dll

 

- Volte ao KillBox. Clique em File > Paste from clipboard. Clique no botão All Files.

 

- Clique no botão . Responda Não à pergunta.

 

Talvez você queira imprimir essas instruções ou salvá-las em um arquivo texto para fácil acesso, pois você não terá acesso ao seu tópico

 

3. Reinicie o PC em entre em modo seguro (pressione F8 durante a inicialização e escolha modo seguro na tela de seleção)

 

4. Abra o HijackThis e clique em Do a system scan only.

 

- Marque SOMENTE as entradas abaixo e clique

 

O4 - HKLM\..\Run: [www.hidro.4t.com ] enbiei.exe

O4 - HKLM\..\Run: [Windows USB controler] winusb.exe

O4 - HKLM\..\Run: [Windows SA] C:\Program Files\WindowsSA\omniscient.exe

O4 - HKLM\..\Run: [Windows Automation] mslaugh.exe

O4 - HKLM\..\Run: [windows auto update] msblast.exe

O4 - HKLM\..\Run: [stcinstaller] c:\installer\id53.exe

O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\System32\bridge.dll",Load

O4 - HKLM\..\Run: [NvVideoCenter] C:\windows\system32\NvVid.exe

O4 - HKLM\..\Run: [NAV Scan Service] NAVscan32.exe

O4 - HKLM\..\Run: [msbb] c:\docume~1\felice~1\config~1\temp\msbb.exe

O4 - HKLM\..\Run: [Microsoft Update Mechene] Updatez.exe

O4 - HKLM\..\Run: [Microsoft Update Configuration] WIN32SNC.exe

O4 - HKLM\..\Run: [Microsoft Restore] scrgrd.exe

O4 - HKLM\..\Run: [Microsoft Inet Xp..] teekids.exe

O4 - HKLM\..\Run: [lsasss.exe] C:\WINDOWS\lsasss.exe

O4 - HKLM\..\Run: [idyrmx] C:\WINDOWS\idyrmx.exe

O4 - HKLM\..\Run: [fhuoqbkf] c:\windows\system32\fhuoqbkf.exe

O4 - HKLM\..\Run: [dfrwurw] C:\WINDOWS\System32\fhuoqbkf.exe

O4 - HKLM\..\Run: [conscorr] C:\WINDOWS\conscorr.exe

O4 - HKLM\..\Run: [COM+ System Applications] lsas.exe

O4 - HKLM\..\Run: [cApp] C:\windows\mbsync.exe /i

O4 - HKLM\..\Run: [avserve2.exe] C:\WINDOWS\avserve2.exe

O4 - HKLM\..\Run: [161A97D0] C:\WINDOWS\System32\zedipisvbvf.exe

O4 - HKLM\..\Run: [$WindowsRegKey%update] IEXPLORE.EXE

O4 - HKCU\..\Run: [dark] C:\windows\xcodex.exe

 

5. - Execute o ATF-Cleaner

 

- Marque Select All.

 

- Depois clique em Empty Selected.

 

- Na janela Done Cleaning clique em OK e depois Exit.

 

6. Localize e delete a pasta em negrito abaixo:

 

C:\Program Files\WindowsSA

 

7. Reinicie em modo normal

 

8. Em seguida faça um scan online com:

http://www.bitdefender.com/scan8/ie.html

 

9. Depois faça um novo log do HijackThis e cole-o na sua resposta para prosseguirmos

 

Verifique se o problema ainda continua.

 

Abraços!

[FCT 0]

Logfile of HijackThis v1.99.1

Scan saved at 20:12, on 2007-09-01

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16512)

 

Running processes:

C:\windows\System32\smss.exe

C:\windows\system32\winlogon.exe

C:\windows\system32\services.exe

C:\windows\system32\lsass.exe

C:\windows\system32\svchost.exe

C:\windows\System32\svchost.exe

C:\windows\Explorer.EXE

C:\windows\system32\spoolsv.exe

C:\windows\system32\ctfmon.exe

C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7Debug\mdm.exe

C:\windows\system32\pctspk.exe

C:\ARQUIV~1\SPEEDB~1\VideoAccelerator.exe

C:\windows\system32\wscntfy.exe

C:\windows\system32\wuauclt.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\windows\system32\taskmgr.exe

C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\AcroRd32.exe

C:\HijackThis.exe

 

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (file missing)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O2 - BHO: &Google Notebook - {CCCCCCD3-666F-4F81-8B69-745DE9F6D897} - C:\Arquivos de programas\Google\Google Notebook\gnotes1.0.2.19-1449761217.dll

O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Arquivos de programas\DAP\DAPIEBar.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar1.dll

O3 - Toolbar: Google Notas - {CCCCCCDB-4DDB-4703-95D4-DD2C526397BF} - C:\Arquivos de programas\Google\Google Notebook\gnotes1.0.2.19-1449761217.dll

O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O8 - Extra context menu item: &Clean Traces - C:\Arquivos de programas\DAP\Privacy Package\dapcleanerie.htm

O8 - Extra context menu item: &Download with &DAP - C:\Arquivos de programas\DAP\dapextie.htm

O8 - Extra context menu item: Anotar esta página (Google Notas) - res://C:\Arquivos de programas\Google\Google Notebook\gnotes1.0.2.19-1449761217.dll/gn_menu1.html

O8 - Extra context menu item: Anotar isto (Google Notas) - res://C:\Arquivos de programas\Google\Google Notebook\gnotes1.0.2.19-1449761217.dll/gn_menu2.html

O8 - Extra context menu item: Download &all with DAP - C:\Arquivos de programas\DAP\dapextie2.htm

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~1\Office10\EXCEL.EXE/3000

O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\ARQUIV~1\ICQ\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\ARQUIV~1\ICQ\ICQ.exe

O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\ARQUIV~1\DAP\DAP.EXE

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1186863458158

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1186863146670

O17 - HKLM\System\CCS\Services\Tcpip\..\{A771E86F-FDBF-47C2-8FC4-23940AAB50B1}: NameServer = 200.204.0.10 200.204.0.138

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: WgaLogon - C:\windows\

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\windows\system32\WPDShServiceObj.dll

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod Service - Apple Computer, Inc. - C:\Arquivos de programas\iPod\bin\iPodService.exe

O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\windows\system32\pctspk.exe

O23 - Service: VideoAcceleratorEngine - Speedbit Ltd. - C:\ARQUIV~1\SPEEDB~1\VideoAcceleratorEngine.exe

 

O desktop voltou a aparecer, espero que não tenha mais nenhum problema...........Muito obrigado pela ajuda...........

[Shine 0]

Opa!

 

Seu log do Hijackthis não apresenta mais problemas com malwares! :)

 

Desabilite e reabilite a Restauração do Sistema para finalizar.

 

Precisando de algo mais nos procure

 

Um grande abraço!

[FCT 0]

Não estou conseguindo desabilitar e reabilitar o sistema, o link que você deu não está carregando...de qualquer maneira, obrigado pela ajuda......Abçs

[Shine 0]

O conteúdo do link é esse:

 

1 - Iniciar -> Programas -> Acessórios -> Windows Explorer

2 - Clique com o botão direito em Meu computador e então clique em Propriedades

3 - Clique na aba Restauração do Sistema

4 - Marque Desativar restauração do sistema

5 - Clique em OK. Você verá uma mensagem. Clique em Sim.

6 - Depois "desmarque" Desativar restauração do sistema e clique em OK para finalizar.

 

PS: É importante que a Restauração do Sistema continue ativado.

 

Abraços! :)

[Sam Spade 2]

PROBLEMA RESOLVIDO!

 

Caso o autor necessite que o tópico seja reaberto é necessário enviar uma Mensagem Privada para um Moderador com um link para o tópico.