[Resolvido!] E o AVG Sumiu!

vinisilva · Julho 23, 2007

Fui escanear o AVG pra ver se tinha algum vírus, e 17 arquivos eu acho, foram infectados, depois eu os coloquei em quarentena, até que o problema fosse resolvido com uma atualização do AVG. Quando eu fui atualizar o AVG deu erro na hora de atualizar e dizia que não podia se conectar ao ip do servidor de update, logo depois, o AVG se fecha sozinho, e quando eu fui abrí-lo aparece aquela mensagem que diz que o arquivo não foi achado, quando eu vou na pasta do AVG todos os executaveis dele some, só ficam os dlls e outros arquivos do programa. Gostaria de saber o que tenho que fazer pra remover essa praga que está no meu pc, fico muito grato.

Logfile of HijackThis v1.99.1

Scan saved at 11:48:19, on 23/7/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\slserv.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Acelerador Terra\slipcore.exe

C:\Arquivos de programas\iGAditivado\Discador iG.exe

C:\ARQUIV~1\TEXTBR~1.0\Bin\INSTAN~1.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Arquivos de programas\Free Download Manager\fdm.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\slrundll.exe

C:\ARQUIV~1\MOZILL~1\FIREFOX.EXE

C:\WINDOWS\SYSTEM32\notepad.exe

C:\Documents and Settings\Meninos\Desktop\[Hijakthis]\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://farejador.ig.com.br/ie/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://farejador.ig.com.br

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = acelerador.br.inter.net:61798

O1 - Hosts: 87.117.202.117 nprotect.roseonlinegame.com

O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\ARQUIV~1\MEGAUP~1\MEGAUP~1.DLL

O2 - BHO: Accelerator Plugin - {656EC4B7-072B-4698-B504-2A414C1F0037} - C:\ARQUIV~1\ACELER~2\PRPL_I~1.DLL

O2 - BHO: (no name) - {6EF05952-B48D-4944-AA91-57A6A1A48EF8} - C:\Arquivos de programas\Puxa Rápido\IEBHO.DLL

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: &iG - {7EEF1E3D-FD97-4401-BCDB-5827F2D11709} - C:\ARQUIV~1\IGV6\igshop.dll

O2 - BHO: NOW!Imaging - {9AA2F14F-E956-44B8-8694-A5B615CDF341} - C:\Arquivos de programas\Acelerador Terra\components\NOWImaging.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar2.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Arquivos de programas\Free Download Manager\iefdmcks.dll

O2 - BHO: (no name) - {FCADDC14-BD46-408A-9842-CDBE1C6D37EB} - C:\WINDOWS\svchosts.dll

O3 - Toolbar: &iG - {7EEF1E3D-FD97-4401-BCDB-5827F2D11709} - C:\ARQUIV~1\IGV6\igshop.dll

O3 - Toolbar: Acelerador Terra - {8B79EE88-E62D-4AA8-B530-CC357BA112B7} - C:\Arquivos de programas\Acelerador Terra\Toolband.dll

O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\ARQUIV~1\MEGAUP~1\MEGAUP~1.DLL

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar2.dll

O4 - HKLM\..\Run: [AVG7_CC] C:\ARQUIV~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [slipStream] "C:\Arquivos de programas\Acelerador Terra\slipcore.exe"

O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Asus Probe\AsusProb.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [Atualizador - Puxa Rápido] C:\Arquivos de programas\Puxa Rápido\Atualiza.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [Discador iG] "C:\Arquivos de programas\iGAditivado\Discador iG.exe" boot

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [instantAccess] C:\ARQUIV~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /h

O4 - HKLM\..\Run: [RegisterDropHandler] C:\ARQUIV~1\TEXTBR~1.0\Bin\REGIST~1.EXE

O4 - HKLM\..\Run: [Propel Accelerator] "C:\Arquivos de programas\Acelerador Propel Edição iG\trayctl.exe" /STARTUPLAUNCH

O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\ARQUIV~1\TEXTBR~1.0\Bin\REGIST~1.EXE

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [Free Download Manager] C:\Arquivos de programas\Free Download Manager\fdm.exe -autorun

O4 - Startup: Adobe Gamma.lnk = C:\Arquivos de programas\Arquivos comuns\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Startup: hamachi.lnk = C:\Arquivos de programas\Hamachi\hamachi.exe

O4 - Startup: Joystick To Mouse.lnk = C:\DESKTOP\JOY2MS32.EXE

O4 - Global Startup: Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: &Pesquisa do Google - res://C:\Arquivos de programas\Google\GoogleToolbar1.dll/cmsearch.html

O8 - Extra context menu item: &Traduzir palavra em inglês - res://C:\Arquivos de programas\Google\GoogleToolbar1.dll/cmwordtrans.html

O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlall.htm

O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlselected.htm

O8 - Extra context menu item: Download with Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dllink.htm

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Instantâneo da página em cache - res://C:\Arquivos de programas\Google\GoogleToolbar1.dll/cmcache.html

O8 - Extra context menu item: Links para esta página - res://C:\Arquivos de programas\Google\GoogleToolbar1.dll/cmbacklinks.html

O8 - Extra context menu item: Páginas semelhantes - res://C:\Arquivos de programas\Google\GoogleToolbar1.dll/cmsimilar.html

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra button: Barra do iG - {FD1672E0-AE0D-465B-B345-F7B0944A121D} - C:\ARQUIV~1\IGV6\igshop.dll

O11 - Options group: [iNTERNATIONAL] International*

O12 - Plugin for .spop: C:\Arquivos de programas\Internet Explorer\Plugins\NPDocBox.dll

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by104fd.bay104.hotmail.msn.com/resources/MsnPUpld.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{4B905D6D-ECD4-46B1-8074-56D7CDC42170}: NameServer = 200.222.0.34 200.202.193.75

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: ComPlusSetup - C:\WINDOWS\system32\catsrvut.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Arquivos de programas\Arquivos comuns\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: IMG Joystick-To-Mouse Service (IMGJTM) - Unknown owner - C:\DESKTOP\IMGJTM.EXE (file missing)

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe

jgarcia · Julho 24, 2007

Opa vinisilva,

Baixe o F-Secure Blacklight em:

F-Secure Blacklight

Salve-o em sua área de trabalho (desktop) e o execute. Aceite o acordo. Clique em Scan e aguarde.

Se ele encontrar algum arquivo, ignore, pois quero apenas o log.

Ao final do scan será gerado o arquivo fsbl-xxxxx.log (onde xxx são números). Preciso que você copie o log e poste em sua próxima resposta.

Abraços.

vinisilva · Julho 25, 2007

Opa,O log que você me pediu.07/25/07 10:42:56 [info]: BlackLight Engine 1.0.64 initialized07/25/07 10:42:56 [info]: OS: 5.1 build 2600 (Service Pack 2)07/25/07 10:42:56 [Note]: 7019 407/25/07 10:42:56 [Note]: 7005 007/25/07 10:42:59 [Note]: 7006 007/25/07 10:42:59 [Note]: 7011 84007/25/07 10:42:59 [Note]: 7026 007/25/07 10:42:59 [Note]: 7026 007/25/07 10:43:02 [Note]: FSRAW library version 1.7.102207/25/07 10:43:48 [Note]: 7006 007/25/07 10:43:48 [Note]: 7011 84007/25/07 10:43:48 [Note]: 7026 007/25/07 10:43:49 [Note]: 7026 007/25/07 10:43:50 [Note]: FSRAW library version 1.7.102207/25/07 10:44:37 [Note]: 7007 0

jgarcia · Julho 25, 2007

Opa vinisilva,

Baixe o ComboFix em:

ComboFix

1) Dê um duplo-clique no combofix.exe e tecle "Y" para prosseguir. O processo vai durar, em média, 10 minutos;

2) O ComboFix reiniciará o PC automaticamente, a fim de que o processo de remoção seja finalizado (somente se houver infecção);

3) Quando a varredura acabar, será gerado um log, que estará em C:\ComboFix.txt;

4) Não clique na janela do ComboFix, nem feche clicando no X, enquanto a ferramenta estiver sendo executada, pois isto implicará na desconfiguração de seu desktop (ele ficará todo branco);

5) Para parar ou sair do ComboFix, tecle "N";

6) Preciso que você cole o conteúdo do ComboFix.txt em sua próxima resposta.

Abraços.

vinisilva · Julho 25, 2007

Segue abaixo o log:

"Meninos" - 2007-07-25 20:18:16 [GMT -3:00] - ComboFix 07-07-24 - Service Pack 2 FAT32

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\start.exe

((((((((((((((((((((((((( Files Created from 2007-06-25 to 2007-07-25 )))))))))))))))))))))))))))))))

2007-07-25 20:16 51,200 --a------ C:\WINDOWS\nircmd.exe

2007-07-24 13:52 <DIR> d-------- C:\DOCUME~1\Meninos\DADOSD~1\Audacity

2007-07-24 10:27 12,545,331 --------- C:\AVG7QT.DAT

2007-07-24 10:27 <DIR> d-------- C:\Arquivos de programas\Oi Internet

2007-07-23 21:16 64,142 --a------ C:\WINDOWS\SYSTEM32\svhost.exe

2007-07-23 21:16 144,540 --a------ C:\WINDOWS\SYSTEM32\bsyys.scr

2007-07-23 18:31 95,872 --a------ C:\WINDOWS\SYSTEM32\AvastSS.scr

2007-07-23 18:31 94,552 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aswmon2.sys

2007-07-23 18:31 85,952 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aswmon.sys

2007-07-23 18:31 745,600 --a------ C:\WINDOWS\SYSTEM32\aswBoot.exe

2007-07-23 18:31 43,176 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aswTdi.sys

2007-07-23 18:31 26,888 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aavmker4.sys

2007-07-23 18:31 23,416 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aswRdr.sys

2007-07-23 18:31 <DIR> d-------- C:\Arquivos de programas\Alwil Software

2007-07-23 14:20 <DIR> d-------- C:\WINDOWS\SYSTEM32\NtmsData

2007-07-23 12:42 557,056 --a------ C:\DOCUME~1\ADMINI~1\NTUSER.DAT

2007-07-23 12:42 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Dados de aplicativos

2007-07-23 12:42 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Menu Iniciar

2007-07-23 12:42 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Modelos

2007-07-23 12:42 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Configura‡äes locais

2007-07-23 12:42 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ambiente de rede

2007-07-23 12:42 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ambiente de impressÆo

2007-07-23 12:42 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Meus documentos

2007-07-23 12:42 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Favoritos

2007-07-23 11:26 24,060 --a------ C:\WINDOWS\SYSTEM32\gbiehh.exe

2007-07-23 11:23 587,944 --a------ C:\WINDOWS\SYSTEM32\svhost.pif

2007-06-29 19:10 1,165 --a------ C:\WINDOWS\mozver.dat

2007-06-29 10:34 <DIR> d-------- C:\DOCUME~1\Meninos\DADOSD~1\Talkback

2007-06-29 10:33 0 --a------ C:\WINDOWS\nsreg.dat

2007-06-28 10:52 69,632 --a------ C:\WINDOWS\SYSTEM32\lfgif13n.dll

2007-06-28 10:52 57,344 --a------ C:\WINDOWS\SYSTEM32\lfbmp13n.dll

2007-06-28 10:52 55,808 --a------ C:\WINDOWS\SYSTEM32\lfpsd13n.dll

2007-06-28 10:52 462,848 --a------ C:\WINDOWS\SYSTEM32\ltkrn13n.dll

2007-06-28 10:52 450,560 --a------ C:\WINDOWS\SYSTEM32\ltimg13n.dll

2007-06-28 10:52 401,408 --a------ C:\WINDOWS\SYSTEM32\lfcmp13n.dll

2007-06-28 10:52 299,008 --a------ C:\WINDOWS\SYSTEM32\ltdis13n.dll

2007-06-28 10:52 206,336 --a------ C:\WINDOWS\SYSTEM32\ltefx13n.dll

2007-06-28 10:52 163,840 --a------ C:\WINDOWS\SYSTEM32\ltfil13n.dll

2007-06-28 10:52 159,744 --a------ C:\WINDOWS\SYSTEM32\lfpng13n.dll

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-15 01:43:54 172,032 ----a-w C:\WINDOWS\system32\cncs32.dll

2007-06-14 07:13:28 -------- d-----w C:\Arquivos de programas\KAIZEN Games

2007-06-11 21:16:24 -------- d-----w C:\DOCUME~1\Meninos\DADOSD~1\CyberLink

2007-06-09 21:55:42 25,544 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys

2007-06-07 03:57:54 -------- d-----w C:\Arquivos de programas\Hamachi

2007-05-16 15:13:54 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll

2007-05-02 01:25:20 1,386,496 ----a-w C:\WINDOWS\system32\msvbvm60.dll

2007-04-25 14:22:28 144,896 ----a-w C:\WINDOWS\system32\schannel.dll

2007-04-12 00:54:52 22,016 ----a-w C:\DOCUME~1\Meninos\DADOSD~1\GDIPFONTCACHEV1.DAT

2007-02-04 15:49:48 266 --sh--w C:\Arquivos de programas\desktop.ini

2007-02-04 15:49:48 11,280 ---h--w C:\Arquivos de programas\folder.htt

2005-04-01 01:17:42 40,960 ----a-w C:\Arquivos de programas\Uninstall_CDS.exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SlipStream"="C:\Arquivos de programas\Acelerador Terra\slipcore.exe" [2006-05-23 16:14]

"ASUS Probe"="C:\Program Files\ASUS\Asus Probe\AsusProb.exe" [2002-12-06 16:07]

"nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\SYSTEM32\nwiz.exe]

"Atualizador - Puxa Rápido"="C:\Arquivos de programas\Puxa Rápido\Atualiza.exe" []

"Discador iG"="C:\Arquivos de programas\iGAditivado\Discador iG.exe" [2007-02-22 14:28]

"InstantAccess"="C:\ARQUIV~1\TEXTBR~1.0\Bin\INSTAN~1.exe" [1998-12-14 11:49]

"RegisterDropHandler"="C:\ARQUIV~1\TEXTBR~1.0\Bin\REGIST~1.EXE" [1998-12-14 10:42]

"Propel Accelerator"="C:\Arquivos de programas\Acelerador Propel Edição iG\trayctl.exe" []

"avast!"="C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe" []

"AVG7_CC"="C:\ARQUIV~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-07-24 16:58]

"AVG7_EMC"="C:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe" [2007-07-24 16:58]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:45]

"msnmsgr"="C:\Arquivos de programas\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]

"swg"="C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-23 23:27]

"Free Download Manager"="C:\Arquivos de programas\Free Download Manager\fdm.exe" [2006-08-21 00:24]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]

"RegisterDropHandler"=C:\ARQUIV~1\TEXTBR~1.0\Bin\REGIST~1.EXE

C:\Documents and Settings\Meninos\Menu Iniciar\Programas\Inicializar\

Adobe Gamma.lnk - C:\Arquivos de programas\Arquivos comuns\Adobe\Calibration\Adobe Gamma Loader.exe [2007-03-18 12:42:45]

hamachi.lnk - C:\Arquivos de programas\Hamachi\hamachi.exe [2007-06-07 00:57:53]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ComPlusSetup]

C:\WINDOWS\system32\catsrvut.dll 2005-07-26 01:40 625152 C:\WINDOWS\SYSTEM32\catsrvut.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]

"LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

R0 RecAgent;RecAgent;C:\WINDOWS\system32\DRIVERS\RecAgent.sys

R1 aslm75;aslm75;\??\C:\WINDOWS\system32\drivers\aslm75.sys

R1 NPPTNT2;NPPTNT2;\??\C:\WINDOWS\system32\npptNT2.sys

R2 ppsio2;PPDevice;C:\WINDOWS\system32\drivers\ppsio2.sys

R3 Mtlmnt5;Mtlmnt5;C:\WINDOWS\system32\DRIVERS\Mtlmnt5.sys

R3 Mtlstrm;Mtlstrm;C:\WINDOWS\system32\DRIVERS\Mtlstrm.sys

R3 senfilt;senfilt;C:\WINDOWS\system32\drivers\senfilt.sys

R3 Slntamr;Smart Link 56K Modem Driver;C:\WINDOWS\system32\DRIVERS\slntamr.sys

R3 SlNtHal;SlNtHal;C:\WINDOWS\system32\DRIVERS\Slnthal.sys

R3 SlWdmSup;SlWdmSup;C:\WINDOWS\system32\DRIVERS\SlWdmSup.sys

R3 SPCA508A;11043;C:\WINDOWS\system32\DRIVERS\SP508PIX.SYS

S2 IMGJTM;IMG Joystick-To-Mouse Service;C:\DESKTOP\IMGJTM.EXE

S3 NtMtlFax;NtMtlFax;C:\WINDOWS\system32\DRIVERS\NtMtlFax.sys

S3 XDva012;XDva012;\??\C:\WINDOWS\system32\XDva012.sys

S3 XDva019;XDva019;\??\C:\WINDOWS\system32\XDva019.sys

S3 XTrapD12;XTrapD12;\??\C:\WINDOWS\system32\XTrapD12.sys

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-07-25 20:19:37

Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

Completion time: 2007-07-25 20:20:06

C:\ComboFix-quarantined-files.txt ... 2007-07-25 20:20

--- E O F ---

jgarcia · Julho 26, 2007

Opa vinisilva,

1. Baixe o BankerFix.

2. Desative o seu anti-vírus temporariamente.

3. Dê um duplo-clique sobre o bankerfix.exe. Uma mensagem aparecerá avisando que o mesmo será baixado via internet. Clique em Ok -> Ok. Aperte Enter e aguarde o término do scan.

4. Terminado o scan, leia a mensagem na tela e aperte Enter novamente.

5. Habilite o seu anti-vírus.

6. Retorne com um novo log do HijackThis, juntamente com o relatorio.txt do BankerFix (ele estará em C:\LinhaDefensiva\).

7. Depois de postar a sua resposta você poderá deletar a pasta LinhaDefensiva contida no C.

Abraços.

vinisilva · Julho 26, 2007

Log do Hijackthis

Logfile of HijackThis v1.99.1

Scan saved at 10:20:13, on 26/7/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\WINDOWS\system32\spoolsv.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\slserv.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Acelerador Terra\slipcore.exe

C:\Arquivos de programas\iGAditivado\Discador iG.exe

C:\ARQUIV~1\TEXTBR~1.0\Bin\INSTAN~1.EXE

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgcc.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe

C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Arquivos de programas\Free Download Manager\fdm.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\slrundll.exe

C:\ARQUIV~1\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Documents and Settings\Meninos\Desktop\HijackThis.exe