[Resolvido!] com Log

d.aguiar · Agosto 1, 2007

Alguém pode me ajudar analisando o meu log?

C:\WINDOWS\system32\directx.exe parece ser um possível worm.

Logfile of HijackThis v1.99.1

Scan saved at 13:00:39, on 1/8/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Java\jre1.5.0_05\bin\jusched.exe

C:\Arquivos de programas\Java\jre1.5.0_05\bin\jucheck.exe

C:\WINDOWS\Samsung\PanelMgr\ssmmgr.exe

C:\Arquivos de programas\ATI Technologies\ATI.ACE\CLI.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\system32\rundll32.exe

C:\Arquivos de programas\Nokia\Nokia PC Suite 6\LaunchApplication.exe

C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe

C:\Arquivos de programas\iTunes\iTunesHelper.exe

C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe

C:\Arquivos de programas\MOZAT\MorangeDesktop\modesktop.exe

C:\ARQUIV~1\MICROS~2\wcescomm.exe

C:\Arquivos de programas\IVT Corporation\BlueSoleil\BlueSoleil.exe

C:\ARQUIV~1\MICROS~2\rapimgr.exe

C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe

C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe

C:\ARQUIV~1\Grisoft\AVG7\avgemc.exe

C:\Arquivos de programas\IVT Corporation\BlueSoleil\BTNtService.exe

C:\WINDOWS\system32\nbridge.exe

C:\Arquivos de programas\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\PC Connectivity Solution\ServiceLayer.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexStoreSvr.exe

C:\Arquivos de programas\iPod\bin\iPodService.exe

C:\Arquivos de programas\ATI Technologies\ATI.ACE\cli.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Sun\explorer.exe

C:\Arquivos de programas\Uniblue\SpyEraser\SpyEraser.exe

C:\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.compartilhando.org/

O1 - Hosts: 02

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: del.icio.us Toolbar Helper - {7AA07AE6-01EF-44EC-93CA-9D7CD41CCDB6} - C:\Arquivos de programas\del.icio.us\Internet Explorer Buttons\dlcsIE.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: G-Buster Browser Defense ABN AMRO - {C41A1C0E-EA6C-11D4-B1B8-444553540007} - C:\WINDOWS\Downloaded Program Files\gbiehabn.dll

O2 - BHO: G-Buster Browser Defense Unibanco - {C41A1C0E-EA6C-11D4-B1B8-444553540008} - C:\WINDOWS\Downloaded Program Files\gbiehuni.dll

O3 - Toolbar: del.icio.us - {981FE6A8-260C-4930-960F-C3BC82746CB0} - C:\Arquivos de programas\del.icio.us\Internet Explorer Buttons\dlcsIE.dll

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Arquivos de programas\Java\jre1.5.0_05\bin\jusched.exe

O4 - HKLM\..\Run: [Launch Ai Booster] "C:\Arquivos de programas\ASUS\Ai Booster\OverClk.exe"

O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe

O4 - HKLM\..\Run: [ATICCC] "C:\Arquivos de programas\ATI Technologies\ATI.ACE\CLIStart.exe"

O4 - HKLM\..\Run: [samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\ssmmgr.exe /autorun

O4 - HKLM\..\Run: [TkBellExe] "realsched.exe" -osboot

O4 - HKLM\..\Run: [googletalk] C:\Arquivos de programas\Google\Google Talk\googletalk.exe /autostart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Arquivos de programas\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [AVG7_CC] C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\K-Lite Codec Pack\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Arquivos de programas\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [MobileDesktop] C:\Arquivos de programas\MOZAT\MorangeDesktop\modesktop.exe

O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\ARQUIV~1\MICROS~2\wcescomm.exe"

O4 - HKCU\..\Run: [uniblue SpyEraser] "C:\Arquivos de programas\Uniblue\SpyEraser\SpyEraser.exe" -m

O4 - Startup: Adobe Gamma.lnk = C:\Arquivos de programas\Arquivos comuns\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: BlueSoleil.lnk = ?

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~1\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_05\bin\npjpi150_05.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_05\bin\npjpi150_05.dll

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\ARQUIV~1\MICROS~2\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\ARQUIV~1\MICROS~2\INetRepl.dll

O9 - Extra 'Tools' menuitem: Criar Favorito Móvel... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\ARQUIV~1\MICROS~2\INetRepl.dll

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~1\OFFICE11\REFIEBAR.DLL

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O14 - IERESET.INF: START_PAGE_URL=http://www.compartilhando.org/

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab

O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399007} (GbPluginObj Class) - https://wwws.realsecureweb.com.br/mpr/plugi...GbPluginABN.cab

O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399008} (GbPluginObj Class) - https://clickbanking.unibanco.com.br/GbPlug...GbPluginUni.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Arquivos de programas\Arquivos comuns\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgemc.exe

O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Arquivos de programas\IVT Corporation\BlueSoleil\BTNtService.exe

O23 - Service: Gbp Service (GbpSv) - GAS Tecnologia LTDA - C:\Arquivos de programas\GbPlugin\GbpSv.exe

O23 - Service: iPod Service - Apple Inc. - C:\Arquivos de programas\iPod\bin\iPodService.exe

O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Arquivos de programas\Arquivos comuns\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

O23 - Service: Nokia Network Bridge - Nokia - C:\WINDOWS\system32\nbridge.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: ServiceLayer - Nokia. - C:\Arquivos de programas\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: DirectX Service (Solic) - Unknown owner - C:\WINDOWS\system32\directx.exe

O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Arquivos de programas\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

jgarcia · Agosto 6, 2007

Opa d.aguiar,

Baixe o ComboFix em:

ComboFix

1) Dê um duplo-clique no combofix.exe e tecle "Y" para prosseguir. O processo vai durar, em média, 10 minutos;

2) O ComboFix reiniciará o PC automaticamente, a fim de que o processo de remoção seja finalizado (somente se houver infecção);

3) Quando a varredura acabar, será gerado um log, que estará em C:\ComboFix.txt;

4) Não clique na janela do ComboFix, nem feche clicando no X, enquanto a ferramenta estiver sendo executada, pois isto implicará na desconfiguração de seu desktop (ele ficará todo branco);

5) Para parar ou sair do ComboFix, tecle "N";

6) Preciso que você cole o conteúdo do ComboFix.txt em sua próxima resposta, juntamente com um novo log do HijackThis.

Abraços.

d.aguiar · Agosto 7, 2007

Obrigado pela resposta jgarcia

o log do combofix é esse:

(ps: o sistema não foi reiniciado)

ComboFix 07-08-04.3 - "Daniel" 2007-08-07 3:17:46.1 [GMT -3:00] - NTFS

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.Verdadeiro

* Created a new restore point

((((((((((((((((((((((((( Files Created from 2007-07-07 to 2007-08-07 )))))))))))))))))))))))))))))))

2007-08-07 03:16 51,200 --a------ C:\WINDOWS\nircmd.exe

2007-08-03 18:42 <DIR> d-------- C:\Arquivos de programas\iTunes

2007-08-03 18:42 <DIR> d-------- C:\Arquivos de programas\iPod

2007-08-01 15:17 <DIR> d-------- C:\WINDOWS\system32\ActiveScan

2007-08-01 12:52 <DIR> d-------- C:\HijackThis

2007-08-01 12:48 <DIR> d-------- C:\Arquivos de programas\Uniblue

2007-07-26 16:22 <DIR> d-------- C:\Arquivos de programas\HeroStats Unstable

2007-07-26 16:16 <DIR> d-------- C:\binds

2007-07-26 15:59 <DIR> d-------- C:\DOCUME~1\Daniel\DADOSD~1\InstallShield

2007-07-21 04:21 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Macromedia Shared

2007-07-13 14:22 <DIR> d-------- C:\MsgPools

2007-07-10 12:13 <DIR> d-------- C:\DOCUME~1\Daniel\DADOSD~1\Joost

2007-07-10 12:13 <DIR> d-------- C:\Arquivos de programas\Joost

2007-07-07 00:10 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\Apple

2007-07-07 00:10 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Apple

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-06 23:14 --------- d-------- C:\Arquivos de programas\City of Heroes

2007-08-01 15:44 --------- d-------- C:\Arquivos de programas\PC Connectivity Solution

2007-08-01 15:43 --------- d-------- C:\Arquivos de programas\MSN Messenger

2007-08-01 15:43 --------- d-------- C:\Arquivos de programas\Microsoft ActiveSync

2007-08-01 15:40 --------- d-------- C:\Arquivos de programas\GbPlugin

2007-08-01 12:48 --------- d-------- C:\DOCUME~1\Daniel\DADOSD~1\Uniblue

2007-07-28 01:18 --------- d-------- C:\Arquivos de programas\eMule

2007-07-26 16:35 --------- d--h----- C:\Arquivos de programas\InstallShield Installation Information

2007-07-26 16:22 --------- d-------- C:\Arquivos de programas\HeroStats

2007-07-11 11:29 66006 --a------ C:\WINDOWS\system32\perfc016.dat

2007-07-11 11:29 422200 --a------ C:\WINDOWS\system32\perfh016.dat

2007-06-29 13:47 --------- d-------- C:\Arquivos de programas\Futuremark

2007-06-26 12:51 --------- d-------- C:\DOCUME~1\Daniel\DADOSD~1\LimeWire

2007-06-20 01:15 532480 --a------ C:\WINDOWS\system32\The Simpsons Movie - Sleeping Homer.scr

2007-06-18 12:11 --------- d-------- C:\Arquivos de programas\Nokia

2007-06-18 12:11 --------- d-------- C:\Arquivos de programas\Arquivos comuns\Nokia

2007-06-08 21:36 --------- d-------- C:\Arquivos de programas\smart2go Maploader

2007-06-08 21:10 --------- d-------- C:\Arquivos de programas\Arquivos comuns\Wise Installation Wizard

2007-06-07 02:47 --------- d-------- C:\Arquivos de programas\eRightSoft

2007-05-18 20:25 81920 --a------ C:\DOCUME~1\Daniel\DADOSD~1\ezpinst.exe

2007-05-18 20:25 47360 --a------ C:\DOCUME~1\Daniel\DADOSD~1\pcouffin.sys

2007-05-18 20:25 14 --a------ C:\WINDOWS\system32\systeminfo3.dll

2007-05-16 12:13 86528 --------- C:\WINDOWS\system32\dllcache\directdb.dll

2007-05-16 12:13 85504 --------- C:\WINDOWS\system32\dllcache\wabimp.dll

2007-05-16 12:13 683520 --a------ C:\WINDOWS\system32\inetcomm.dll

2007-05-16 12:13 683520 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll

2007-05-16 12:13 510976 --------- C:\WINDOWS\system32\dllcache\wab32.dll

2007-05-16 12:13 1314816 --------- C:\WINDOWS\system32\dllcache\msoe.dll

2006-05-03 09:06:54 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll

2007-02-21 10:47:16 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SunJavaUpdateSched"="C:\Arquivos de programas\Java\jre1.5.0_05\bin\jusched.exe" [2005-08-26 17:14]

"Launch Ai Booster"="C:\Arquivos de programas\ASUS\Ai Booster\OverClk.exe" [2005-08-04 13:24]

"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-03-17 15:10 C:\WINDOWS\system32\Hdaudpropshortcut.exe]

"ATICCC"="C:\Arquivos de programas\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 08:12]

"Samsung PanelMgr"="C:\WINDOWS\Samsung\PanelMgr\ssmmgr.exe" [2006-06-07 08:25]

"TkBellExe"="realsched.exe" []

"googletalk"="C:\Arquivos de programas\Google\Google Talk\googletalk.exe" [2007-01-01 19:54]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-06-15 06:20]

"nwiz"="nwiz.exe" [2005-06-15 06:20 C:\WINDOWS\system32\nwiz.exe]

"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-06-15 06:20]

"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 00:45 C:\WINDOWS\system32\bthprops.cpl]

"PCSuiteTrayApplication"="C:\Arquivos de programas\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 13:20]

"NeroFilterCheck"="C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe" [2007-03-09 18:53]

"AVG7_CC"="C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe" [2007-07-22 13:06]

"QuickTime Task"="C:\Arquivos de programas\K-Lite Codec Pack\QuickTime\QTTask.exe" [2007-06-29 06:24]

"iTunesHelper"="C:\Arquivos de programas\iTunes\iTunesHelper.exe" [2007-07-10 09:18]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MsnMsgr"="C:\Arquivos de programas\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 13:49]

"MobileDesktop"="C:\Arquivos de programas\MOZAT\MorangeDesktop\modesktop.exe" [2007-05-11 08:01]

"H/PC Connection Agent"="C:\ARQUIV~1\MICROS~2\wcescomm.exe" [2005-11-15 20:41]

"Uniblue SpyEraser"="C:\Arquivos de programas\Uniblue\SpyEraser\SpyEraser.exe" [2007-07-24 13:21]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]

"nlsf"=cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll"

"tscuninstall"=%systemroot%\system32\tscupgrd.exe

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]

"MsnMsgr"="C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background

"Nokia.PCSync"=C:\Arquivos de programas\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

C:\Documents and Settings\Daniel\Menu Iniciar\Programas\Inicializar\

Adobe Gamma.lnk - C:\Arquivos de programas\Arquivos comuns\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50]

C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\

Adobe Reader Speed Launch.lnk - C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 03:44:06]

BlueSoleil.lnk - C:\Arquivos de programas\IVT Corporation\BlueSoleil\BlueSoleil.exe [2007-05-08 06:45:22]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"ForceClassicControlPanel"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoSharedDocuments"=1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"NoSharedDocuments"=1 (0x1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{E37CB5F0-51F5-4395-A808-5FA49E399007}"= C:\WINDOWS\Downloaded Program Files\gbiehabn.dll [2007-01-10 14:08 222392]

"{E37CB5F0-51F5-4395-A808-5FA49E399008}"= C:\WINDOWS\Downloaded Program Files\gbiehuni.dll [2007-03-06 10:00 222376]

R0 BTHidMgr;Bluetooth HID Manager Service;C:\WINDOWS\system32\Drivers\BTHidMgr.sys

R1 AsIO;AsIO;C:\WINDOWS\system32\drivers\AsIO.sys

R2 DgiVecp;DgiVecp;\??\C:\WINDOWS\system32\Drivers\DgiVecp.sys

R2 Nokia Network Bridge;Nokia Network Bridge;C:\WINDOWS\system32\nbridge.exe

R3 BlueletAudio;Bluetooth Audio Service;C:\WINDOWS\system32\DRIVERS\blueletaudio.sys

R3 BT;Bluetooth PAN Network Adapter;C:\WINDOWS\system32\DRIVERS\btnetdrv.sys

R3 BTHidEnum;Bluetooth HID Enumerator;C:\WINDOWS\system32\DRIVERS\vbtenum.sys

R3 MTsensor;ATK0110 ACPI UTILITY;C:\WINDOWS\system32\DRIVERS\ASACPI.sys

R3 Nokia Network Bridge Driver;Nokia Network Bridge Driver;\??\C:\WINDOWS\system32\Drivers\nbridge.sys

R3 pcouffin;VSO Software pcouffin;C:\WINDOWS\system32\Drivers\pcouffin.sys

R3 ROOTMODEM;Microsoft Legacy Modem Driver;C:\WINDOWS\system32\Drivers\RootMdm.sys

R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver;C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys

R3 VComm;Virtual Serial port driver;C:\WINDOWS\system32\DRIVERS\VComm.sys

R3 VcommMgr;Bluetooth VComm Manager Service;C:\WINDOWS\system32\Drivers\VcommMgr.sys

S2 GbpSv;Gbp Service;C:\Arquivos de programas\GbPlugin\GbpSv.exe

S2 Solic;DirectX Service;C:\WINDOWS\system32\directx.exe

S3 Btcsrusb;Bluetooth USB For Bluetooth Service;C:\WINDOWS\system32\Drivers\btcusb.sys

S3 nmwcd;Nokia USB Phone Parent;C:\WINDOWS\system32\drivers\nmwcd.sys

S3 nmwcdc;Nokia USB Generic;C:\WINDOWS\system32\drivers\nmwcdc.sys

S3 nmwcdcj;Nokia USB Port;C:\WINDOWS\system32\drivers\nmwcdcj.sys

S3 nmwcdcm;Nokia USB Modem;C:\WINDOWS\system32\drivers\nmwcdcm.sys

S3 P1110VID;Creative WebCam NX;C:\WINDOWS\system32\DRIVERS\P1110Vid.sys

S3 RFCOMM;Dispositivo Bluetooth (TDI do Protocolo RFCOMM);C:\WINDOWS\system32\DRIVERS\rfcomm.sys

S3 usb_rndisx;USB RNDIS Adapter;C:\WINDOWS\system32\DRIVERS\usb8023x.sys

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs BthServ

Contents of the 'Scheduled Tasks' folder

2007-08-03 19:14:05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Arquivos de programas\Apple Software Update\SoftwareUpdate.exe

2007-08-07 02:14:02 C:\WINDOWS\Tasks\Uniblue SpyEraser Nag.job - C:\Arquivos de programas\Uniblue\SpyEraser\SpyEraser.exe

2007-08-06 22:20:39 C:\WINDOWS\Tasks\Uniblue SpyEraser.job - C:\Arquivos de programas\Uniblue\SpyEraser\SpyEraser.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-08-07 03:21:07

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

Completion time: 2007-08-07 3:22:12

--- E O F ---

O novo log do hijackthis ficou assim:

Logfile of HijackThis v1.99.1

Scan saved at 03:24:21, on 7/8/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe

C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe

C:\ARQUIV~1\Grisoft\AVG7\avgemc.exe

C:\Arquivos de programas\IVT Corporation\BlueSoleil\BTNtService.exe

C:\WINDOWS\system32\nbridge.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Arquivos de programas\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Java\jre1.5.0_05\bin\jusched.exe

C:\Arquivos de programas\Java\jre1.5.0_05\bin\jucheck.exe

C:\Arquivos de programas\ASUS\Ai Booster\OverClk.exe

C:\Arquivos de programas\ATI Technologies\ATI.ACE\CLI.EXE

C:\WINDOWS\Samsung\PanelMgr\ssmmgr.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\system32\rundll32.exe

C:\Arquivos de programas\Nokia\Nokia PC Suite 6\LaunchApplication.exe

C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe

C:\Arquivos de programas\PC Connectivity Solution\ServiceLayer.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe

C:\Arquivos de programas\MOZAT\MorangeDesktop\modesktop.exe

C:\ARQUIV~1\MICROS~2\wcescomm.exe

C:\Arquivos de programas\Uniblue\SpyEraser\SpyEraser.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

C:\ARQUIV~1\MICROS~2\rapimgr.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexStoreSvr.exe

C:\Arquivos de programas\IVT Corporation\BlueSoleil\BlueSoleil.exe

C:\Arquivos de programas\ATI Technologies\ATI.ACE\cli.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe