[Arquivado]Tasker.exe O que é?

loi · Setembro 1, 2007

Bom, eu sou novo aqui então paciência ^^O que ocorre é o seguinte, já 2 vezes que estou jogando warcraft III e me aparece 1 mensagem de que o tasker.exe sofreu erro no aplicativo. Então puto da vida, coloquei no google a palavrinha "tasker.exe" e graças a Deus me apareceu esse fórum. Vamos ao que interessa, eis o log:Logfile of HijackThis v1.99.1Scan saved at 06:31:27, on 1/9/2007Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exeC:\Arquivos de programas\Alwil Software\Avast4\ashServ.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\LEXPPS.EXEC:\WINDOWS\system32\VTTimer.exeC:\WINDOWS\WinLogT.exeC:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exeC:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exeC:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exeC:\Arquivos de programas\Last.fm\LastFMHelper.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\wscntfy.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\winmds.exeC:\WINDOWS\system32\msiexec.exeC:\WINDOWS\system32\svchost.exeC:\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.aspO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dllO4 - HKLM\..\Run: [VTTimer] VTTimer.exeO4 - HKLM\..\Run: [WinLogT] C:\WINDOWS\WinLogT.exeO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe"O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osbootO4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /backgroundO4 - Global Startup: Last.fm Helper.lnk = C:\Arquivos de programas\Last.fm\LastFMHelper.exeO8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dllO9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exeO14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.aspO18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLLO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLLO21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dllO23 - Service: Adobe LM Service - Unknown owner - C:\Arquivos de programas\Arquivos comuns\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)O23 - Service: avast! Web Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXEO23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Arquivos de programas\Windows Live\installer\WLSetupSvc.exePor favor, uma resposta pro meu problema ^^

DigRam · Setembro 1, 2007

Boa Noite loi!

>@< Faça o download do ComboFix.

>@< Baixe-o para o Desktop!

>@< Feche todas as janelas e execute a ferramenta!

>@< Para quem possui o Avast,surgirá um alerta de malware ( Win32 D adobra-EY[Trj] ),que deverá ser ignorado.

>@< Abrirá a janela Auto Scan. Aguarde!

>@< Digite a opção para continuar < Enter >

>@< Aguarde a conclusão!

>@< Poste o relatório: C:\ComboFix.txt,na sua resposta + Log do HJT,atualizado.

Abraços!

loi · Setembro 2, 2007

2007-08-17 19:46 <DIR> d-------- C:\Arquivos de programas\1stbenison

2007-08-17 19:37 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\Macrovision

2007-08-17 19:37 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Adobe Systems Shared

2007-08-17 19:35 <DIR> d-------- C:\Arquivos de programas\Real

2007-08-17 19:35 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\xing shared

2007-08-17 19:35 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Real

2007-08-17 19:33 <DIR> d-------- C:\Arquivos de programas\eMule

2007-08-17 19:33 <DIR> d-------- C:\Arquivos de programas\Desliga o Computador

2007-08-17 19:32 <DIR> d-------- C:\DOCUME~1\Loi\DADOSD~1\teamspeak2

2007-08-17 19:32 <DIR> d-------- C:\Arquivos de programas\Teamspeak2_RC2

2007-08-17 19:31 <DIR> d-------- C:\Arquivos de programas\Windows Media Connect 2

2007-08-17 19:30 <DIR> d-------- C:\c7bfc58581f458d6e9145b3a6b4d0bdd

2007-08-17 19:30 <DIR> d-------- C:\Arquivos de programas\Winamp

2007-08-17 19:28 <DIR> d-------- C:\Arquivos de programas\NetLimiter

2007-08-17 19:27 <DIR> d-------- C:\DOCUME~1\Loi\DADOSD~1\LockTime

2007-08-17 19:26 <DIR> d-------- C:\Arquivos de programas\Ocean Technology

2007-08-17 19:22 <DIR> d-------- C:\DOCUME~1\Loi\DADOSD~1\Lavasoft

2007-08-17 19:22 <DIR> d-------- C:\Arquivos de programas\Lavasoft

2007-08-17 19:22 <DIR> d-------- C:\Arquivos de programas\Foxit Software

2007-08-17 19:21 <DIR> d-------- C:\Arquivos de programas\Azureus

2007-08-17 19:20 <DIR> d-------- C:\DOCUME~1\Loi\DADOSD~1\GlobalSCAPE

2007-08-17 19:20 <DIR> d-------- C:\DOCUME~1\Loi\Contacts

2007-08-17 19:19 <DIR> d-------- C:\Arquivos de programas\Messenger Plus! Live

2007-08-17 19:19 <DIR> d-------- C:\Arquivos de programas\Google

2007-08-17 19:19 <DIR> d-------- C:\Arquivos de programas\GlobalSCAPE

2007-08-17 19:18 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE

2007-08-17 19:18 <DIR> d-------- C:\Arquivos de programas\CyberScript32

2007-08-17 19:17 <DIR> d-------- C:\DOCUME~1\Loi\DADOSD~1\Real

2007-08-17 19:17 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\Real

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-09-01 19:09 --------- d--h----- C:\Arquivos de programas\InstallShield Installation Information

2007-09-01 07:27 359040 --a------ C:\WINDOWS\system32\drivers\tcpip.sys

2007-08-27 04:18 --------- d-------- C:\Arquivos de programas\Ahead

2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll

2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll

2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe

2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll

2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll

2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll

2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll

2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll

2007-07-24 17:31 --------- d-------- C:\Arquivos de programas\CyberLink DVD Solution

2007-07-07 23:33 504320 --a------ C:\WINDOWS\system32\winlogon.exe

2007-07-07 23:23 --------- d-------- C:\Arquivos de programas\microsoft frontpage

2007-07-07 23:19 --------- d-------- C:\Arquivos de programas\Arquivos comuns\MSSoap

2007-07-07 20:09 --------- d-------- C:\Arquivos de programas\Arquivos comuns\SpeechEngines

2007-07-07 20:09 --------- d-------- C:\Arquivos de programas\Arquivos comuns\ODBC

2007-06-26 03:10 1104896 --a------ C:\WINDOWS\system32\msxml3.dll

2007-06-19 10:31 282112 --a------ C:\WINDOWS\system32\gdi32.dll

2007-06-13 10:21 1035264 --a------ C:\WINDOWS\explorer.exe

2004-03-11 13:27 40960 --a------ C:\Arquivos de programas\Uninstall_CDS.exe

--------- C:\Arquivos de programas\Serviços on-line

--------- C:\Arquivos de programas\Arquivos comuns\Serviços

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"VTTimer"="VTTimer.exe" [2006-08-03 03:53 C:\WINDOWS\system32\VTTimer.exe]

"WinLogT"="C:\WINDOWS\WinLogT.exe" [2006-02-20 13:08]

"SunJavaUpdateSched"="C:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]

"avast!"="C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe" [2007-07-27 19:03]

"TkBellExe"="C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" [2007-08-17 19:35]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MsnMsgr"="C:\Arquivos de programas\MSN Messenger\MsnMsgr.exe" [2006-06-06 12:38]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Adobe Gamma Loader.lnk]

path=C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\Adobe Gamma Loader.lnk

backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Loi^Menu Iniciar^Programas^Inicializar^hamachi.lnk]

path=C:\Documents and Settings\Loi\Menu Iniciar\Programas\Inicializar\hamachi.lnk

backup=C:\WINDOWS\pss\hamachi.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]

"C:\Arquivos de programas\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]

"C:\Arquivos de programas\Google\Google Talk\googletalk.exe" /autostart

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 1200 Series]

"C:\Arquivos de programas\Lexmark 1200 Series\lxczbmgr.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NetLimiter]

C:\Arquivos de programas\NetLimiter\NetLimiter.exe /s

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]

SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

"C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTrayp]

VTtrayp.exe

R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys

R0 xfilt;VIA SATA IDE Hot-plug Driver;C:\WINDOWS\system32\DRIVERS\xfilt.sys

R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);C:\WINDOWS\system32\DRIVERS\RMSPPPOE.SYS

S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys

*Newly Created Service* - CATCHME

Contents of the 'Scheduled Tasks' folder

2007-09-02 04:33:58 C:\WINDOWS\Tasks\At25.job

2007-09-02 04:33:58 C:\WINDOWS\Tasks\At26.job - C:\WINDOWS\system32\winmds.exe

2007-09-01 08:58:51 C:\WINDOWS\Tasks\At27.job - C:\WINDOWS\system32\winmds.exe

2007-09-01 08:58:51 C:\WINDOWS\Tasks\At28.job

2007-09-01 08:58:51 C:\WINDOWS\Tasks\At29.job - C:\WINDOWS\system32\winmds.exe

2007-09-01 08:58:51 C:\WINDOWS\Tasks\At30.job - C:\WINDOWS\system32\winmds.exe

2007-09-01 17:11:30 C:\WINDOWS\Tasks\At31.job - C:\WINDOWS\system32\winmds.exe

2007-09-01 17:11:30 C:\WINDOWS\Tasks\At32.job - C:\WINDOWS\system32\winmds.exe

2007-09-01 17:11:30 C:\WINDOWS\Tasks\At33.job - C:\WINDOWS\system32\winmds.exe

2007-09-01 17:11:30 C:\WINDOWS\Tasks\At34.job - C:\WINDOWS\system32\winmds.exe

2007-09-01 17:11:30 C:\WINDOWS\Tasks\At35.job

2007-08-30 18:02:53 C:\WINDOWS\Tasks\At36.job - C:\WINDOWS\system32\winmds.exe

2007-08-30 18:02:53 C:\WINDOWS\Tasks\At37.job - C:\WINDOWS\system32\winmds.exe

2007-08-30 18:02:53 C:\WINDOWS\Tasks\At38.job - C:\WINDOWS\system32\winmds.exe

2007-08-30 18:02:53 C:\WINDOWS\Tasks\At39.job - C:\WINDOWS\system32\winmds.exe

2007-09-02 04:33:59 C:\WINDOWS\Tasks\At40.job - C:\WINDOWS\system32\winmds.exe

2007-09-02 04:33:59 C:\WINDOWS\Tasks\At41.job - C:\WINDOWS\system32\winmds.exe

2007-09-02 04:33:59 C:\WINDOWS\Tasks\At42.job

2007-09-02 04:33:59 C:\WINDOWS\Tasks\At43.job

2007-09-02 04:33:59 C:\WINDOWS\Tasks\At44.job - C:\WINDOWS\system32\winmds.exe

2007-09-02 04:33:59 C:\WINDOWS\Tasks\At45.job - C:\WINDOWS\system32\winmds.exe

2007-09-02 04:33:59 C:\WINDOWS\Tasks\At46.job - C:\WINDOWS\system32\winmds.exe

2007-09-02 04:33:59 C:\WINDOWS\Tasks\At47.job - C:\WINDOWS\system32\winmds.exe

2007-09-02 04:33:59 C:\WINDOWS\Tasks\At48.job - C:\WINDOWS\system32\winmds.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-09-02 01:38:55

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

Completion time: 2007-09-02 1:39:21

C:\ComboFix-quarantined-files.txt ... 2007-09-02 01:39

--- E O F ---

loi · Setembro 2, 2007

Boa noite DigRam e obrigado pela predisposição em me ajudar ^^

Log atualizado do HijackThis

Logfile of HijackThis v1.99.1

Scan saved at 01:53:30, on 2/9/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\system32\VTTimer.exe

C:\WINDOWS\WinLogT.exe

C:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe

C:\WINDOWS\system32\svchost.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe

C:\Arquivos de programas\Last.fm\LastFMHelper.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\wuauclt.exe

C:\HijackThis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Arquivos de programas\BitComet\tools\BitCometBHO_1.1.8.30.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Arquivos de programas\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll

O4 - HKLM\..\Run: [VTTimer] VTTimer.exe

O4 - HKLM\..\Run: [WinLogT] C:\WINDOWS\WinLogT.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe"

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osboot

O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background

O4 - Global Startup: Last.fm Helper.lnk = C:\Arquivos de programas\Last.fm\LastFMHelper.exe

O8 - Extra context menu item: Baixar link usando &BitComet - res://C:\Arquivos de programas\BitComet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: Baixar todos os links usando BitComet - res://C:\Arquivos de programas\BitComet\BitComet.exe/AddAllLink.htm

O8 - Extra context menu item: Baixar todos os vídeos usando BitComet - res://C:\Arquivos de programas\BitComet\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Arquivos de programas\BitComet\tools\BitCometBHO_1.1.8.30.dll

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O17 - HKLM\System\CCS\Services\Tcpip\..\{7E1B7A6F-B287-488E-A8BD-18CC21D4A96A}: NameServer = 200.165.132.155 200.149.55.142

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Adobe LM Service - Unknown owner - C:\Arquivos de programas\Arquivos comuns\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Arquivos de programas\Windows Live\installer\WLSetupSvc.exe

DigRam · Setembro 2, 2007

Bom Dia loi!

>@< O Log do ComboFix,saiu sem o cabeçalho...

____________________

>@< Faça o download do Avenger.

>@< Descompacte-o e crie uma pasta para o programa!Coloque esta pasta no Disco Local-C ou Desktop!

>@< Rode o programa e marque Input script manually.

>@< Clique no ícone da lupa!

Files to delete:
C:\WINDOWS\system32\winmds.exe

C:\WINDOWS\Tasks\At25.job

C:\WINDOWS\Tasks\At26.job

C:\WINDOWS\Tasks\At27.job

C:\WINDOWS\Tasks\At28.job

C:\WINDOWS\Tasks\At29.job

C:\WINDOWS\Tasks\At30.job

C:\WINDOWS\Tasks\At31.job

C:\WINDOWS\Tasks\At32.job

C:\WINDOWS\Tasks\At33.job

C:\WINDOWS\Tasks\At34.job

C:\WINDOWS\Tasks\At35.job

C:\WINDOWS\Tasks\At36.job

C:\WINDOWS\Tasks\At37.job

C:\WINDOWS\Tasks\At38.job

C:\WINDOWS\Tasks\At39.job

C:\WINDOWS\Tasks\At40.job

C:\WINDOWS\Tasks\At41.job

C:\WINDOWS\Tasks\At42.job

C:\WINDOWS\Tasks\At43.job

C:\WINDOWS\Tasks\At44.job

C:\WINDOWS\Tasks\At45.job

C:\WINDOWS\Tasks\At46.job

C:\WINDOWS\Tasks\At47.job

C:\WINDOWS\Tasks\At48.job

Folders to delete:

C:\c7bfc58581f458d6e9145b3a6b4d0bdd

>@< Na caixa que abrir,cole o que foi copiado na área do quote,logo àcima!

>@< Clique em Done.

>@< Clique no ícone do semáforo!

>@< Clique em Ok.

>@< O computador irá reiniciar!

_____________________

>@< Faça o download do FxMydoom.exe <!>

>@< Salve-o no Desktop!

>@< Desabilite a Restauração do Sistema.

>@< Com todos os programas fechados e o navegador,dê um duplo clique em FxMydoom.exe <!>

>@< Clique em Start. Aguarde!

>@< Terminando,reinicie o computador e,reabilite a Restauração do Sistema.

>@< Poste então: Avenger.txt + Relatório do FixMydoom + HJT,atualizado.

Abraços!

loi · Setembro 2, 2007

DigRam, só por curiosidade... Esses programas eles fazem o quê? Eu gostaria de me informar também e quem sabe aprender um pouquinho, pra quem sabe futuramente poder ajudar alguém também. Tem algum lugar que eu possa ler algo a respeito? Obrigado pela atenção disponibilizada, mais uma vez ^^

AVENGER

Logfile of The Avenger version 1, by Swandog46

Running from registry key:

\Registry\Machine\System\CurrentControlSet\Services\hyauyabl

*******************

Script file located at: \??\C:\kcgtjpuu.txt

Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\system32\winmds.exe deleted successfully.

File C:\WINDOWS\Tasks\At25.job deleted successfully.

File C:\WINDOWS\Tasks\At26.job deleted successfully.

File C:\WINDOWS\Tasks\At27.job deleted successfully.

File C:\WINDOWS\Tasks\At28.job deleted successfully.

File C:\WINDOWS\Tasks\At29.job deleted successfully.

File C:\WINDOWS\Tasks\At30.job deleted successfully.

File C:\WINDOWS\Tasks\At31.job deleted successfully.

File C:\WINDOWS\Tasks\At32.job deleted successfully.

File C:\WINDOWS\Tasks\At33.job deleted successfully.

File C:\WINDOWS\Tasks\At34.job deleted successfully.

File C:\WINDOWS\Tasks\At35.job deleted successfully.

File C:\WINDOWS\Tasks\At36.job deleted successfully.

File C:\WINDOWS\Tasks\At37.job deleted successfully.

File C:\WINDOWS\Tasks\At38.job deleted successfully.

File C:\WINDOWS\Tasks\At39.job deleted successfully.

File C:\WINDOWS\Tasks\At40.job deleted successfully.

File C:\WINDOWS\Tasks\At41.job deleted successfully.

File C:\WINDOWS\Tasks\At42.job deleted successfully.

File C:\WINDOWS\Tasks\At43.job deleted successfully.

File C:\WINDOWS\Tasks\At44.job deleted successfully.

File C:\WINDOWS\Tasks\At45.job deleted successfully.

File C:\WINDOWS\Tasks\At46.job deleted successfully.

File C:\WINDOWS\Tasks\At47.job deleted successfully.

File C:\WINDOWS\Tasks\At48.job deleted successfully.

Folder C:\c7bfc58581f458d6e9145b3a6b4d0bdd deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

[============================================================]

FXMYDOOM

Symantec W32.Novarg@mm/W32.Mydoom@mm Removal Tool 1.12.0

C:\System Volume Information: (not scanned)

D:\System Volume Information: (not scanned)

F:\System Volume Information: (not scanned)

W32.Novarg@mm/W32.Mydoom@mm has not been found on your computer.

loi · Setembro 2, 2007

HijackThis

Logfile of HijackThis v1.99.1

Scan saved at 14:51:27, on 2/9/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\Explorer.EXE