nanaok 0 Denunciar post Postado Setembro 5, 2007 Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Arquivos de programas\GbPlugin\GbpSv.exe C:\WINDOWS\system32\spoolsv.exe C:\Arquivos de programas\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\nvsvc32.exe C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe C:\Arquivos de programas\HP\hpcoretech\hpcmpmgr.exe C:\Arquivos de programas\Skype@phone\Skype@phone.exe C:\Arquivos de programas\Skype\Phone\Skype.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\arquivos de programas\steam\steam.exe C:\Arquivos de programas\Microsoft ActiveSync\wcescomm.exe C:\ARQUIV~1\MICROS~2\rapimgr.exe C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe C:\Arquivos de programas\Workspace Macro Pro 6.5\WMPHotkeys.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\HPZipm12.exe C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe C:\Arquivos de programas\HP\Digital Imaging\bin\hpqgalry.exe C:\Arquivos de programas\Outlook Express\msimn.exe C:\Arquivos de programas\Skype\Plugin Manager\SkypePM.exe C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE C:\Downloads\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.itau.com.br/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.linux.org R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.linux.org/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\ARQUIV~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Arquivos de programas\BitComet\tools\BitCometBHO_1.1.6.14.dll (file missing) O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Arquivos de programas\RXToolBar\sfcont.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar3.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\Arquivos de programas\GbPlugin\gbiehcef.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar3.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [HP Software Update] "C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Arquivos de programas\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [skype@phone] C:\Arquivos de programas\Skype@phone\Skype@phone.exe O4 - HKLM\..\Run: [EasyMessage] "C:\Arquivos de programas\Easy Messenger\em2.exe" -wait O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [skype] "C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [steam] "c:\arquivos de programas\steam\steam.exe" -silent O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Arquivos de programas\Microsoft ActiveSync\wcescomm.exe" O4 - HKCU\..\Run: [AdobeUpdater] C:\Arquivos de programas\Arquivos comuns\Adobe\Updater5\AdobeUpdater.exe O4 - Startup: Adobe Gamma.lnk = C:\Arquivos de programas\Arquivos comuns\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: The Matrix_ Path of Neo Registration.lnk = ? O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ? O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Inicialização rápida do HP Image Zone.lnk = C:\Arquivos de programas\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Workspace Macro Pro Hotkeys.lnk = C:\Arquivos de programas\Workspace Macro Pro 6.5\WMPHotkeys.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Arquivos de programas\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Arquivos de programas\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Arquivos de programas\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Advanced Email Extractor - res://C:\Arquivos%20de%20programas\Advanced%20Email%20Extractor%20PRO\AeePMsie.dll/page.html O8 - Extra context menu item: Append to existing PDF - res://C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Scan link with AEE - res://C:\Arquivos%20de%20programas\Advanced%20Email%20Extractor%20PRO\AeePMsie.dll/link.html O9 - Extra button: iOpus iMacros - {0483894E-2422-45E0-8384-021AFF1AF3CD} - C:\Arquivos de programas\iMacros\imacros.dll (file missing) O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\ARQUIV~1\MICROS~2\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\ARQUIV~1\MICROS~2\INetRepl.dll O9 - Extra 'Tools' menuitem: Criar Favorito Móvel... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\ARQUIV~1\MICROS~2\INetRepl.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\ARQUIV~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Email Extractor - {AFA7DB99-3E4D-4396-94F8-B0B135BCB472} - res://C:\Arquivos%20de%20programas\Advanced%20Email%20Extractor%20PRO\AeePMsie.dll/page.html (file missing) (HKCU) O9 - Extra 'Tools' menuitem: Advanced Email Extractor - {AFA7DB99-3E4D-4396-94F8-B0B135BCB472} - res://C:\Arquivos%20de%20programas\Advanced%20Email%20Extractor%20PRO\AeePMsie.dll/page.html (file missing) (HKCU) O10 - Unknown file in Winsock LSP: c:\arquivos de programas\bonjour\mdnsnsp.dll O12 - Plugin for .spop: C:\Arquivos de programas\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp O14 - IERESET.INF: START_PAGE_URL=http://www.linux.org O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399003} (GbPluginObj Class) - https://imagem.caixa.gov.br/cab/GbPluginCef.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Arquivos de programas\RXToolBar\sfcont.dll O20 - Winlogon Notify: voicesub32 - C:\WINDOWS\SYSTEM32\voicesub32.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Arquivos de programas\Arquivos comuns\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Arquivos de programas\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Gbp Service (GbpSv) - Unknown owner - C:\Arquivos de programas\GbPlugin\GbpSv.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Arquivos de programas\Windows Live\installer\WLSetupSvc.exe Compartilhar este post Link para o post Compartilhar em outros sites
jgarcia 1 Denunciar post Postado Setembro 10, 2007 Opa nanaok, Baixe o ComboFix em: ComboFix 1) Dê um duplo-clique no combofix.exe e tecle Y para prosseguir. O processo vai durar, em média, 10 minutos; 2) O ComboFix reiniciará o PC automaticamente, a fim de que o processo de remoção seja finalizado (somente se houver infecção); 3) Quando a varredura acabar, será gerado um log, que estará em C:\ComboFix.txt; 4) Não clique na janela do ComboFix, nem feche clicando no X, enquanto a ferramenta estiver sendo executada, pois isto implicará na desconfiguração de seu desktop (ele ficará todo branco); 5) Para parar ou sair do ComboFix, tecle N; 6) Preciso que você cole o conteúdo do ComboFix.txt em sua próxima resposta. Abraços. Compartilhar este post Link para o post Compartilhar em outros sites
nanaok 0 Denunciar post Postado Setembro 10, 2007 ComboFix 07-08-30.3 - "Administrador" 2007-09-06 23:53:15.1 - NTFS x86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.160 [GMT -3:00] C:\WINDOWS\system32\chkdsk.exe not present * Created a new restore point ADS removed - C:\WINDOWS\system32\ntoskrnl.exe: O sistema não pode encontrar o arquivo especificado. ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Arquivos de programas\gbplugin\Cef.gpc C:\Arquivos de programas\gbplugin\Cef.gpc . . . . failed to delete C:\Arquivos de programas\gbplugin\gbieh.gmd C:\WINDOWS\exefld C:\WINDOWS\exefld\127109.exe C:\WINDOWS\exefld\14657765.exe C:\WINDOWS\exefld\1655593.exe C:\WINDOWS\exefld\21254359.exe C:\WINDOWS\exefld\217562.exe C:\WINDOWS\exefld\238203.exe C:\WINDOWS\exefld\28751375.exe C:\WINDOWS\exefld\29122343.exe C:\WINDOWS\exefld\36102671.exe C:\WINDOWS\exefld\43161046.exe C:\WINDOWS\exefld\50509218.exe C:\WINDOWS\exefld\6841671.exe C:\WINDOWS\system32\drivers\hidr.exe C:\WINDOWS\system32\drivers\srosa.sys ((((((((((((((((((((((((( Files Created from 2007-08-07 to 2007-09-07 ))))))))))))))))))))))))))))))) 2007-09-06 23:52 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-09-06 13:12 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\Spybot - Search & Destroy 2007-09-06 12:08 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-09-06 12:07 82,248 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-09-06 12:07 57,672 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-09-06 12:07 40,264 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-09-06 12:07 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-09-06 12:06 <DIR> d-------- C:\DOCUME~1\ADMINI~1\DADOSD~1\PC Tools 2007-09-06 11:52 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Symantec Shared 2007-09-06 11:48 <DIR> d-------- C:\Arquivos de programas\Spyware Doctor 2007-09-06 11:40 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-09-06 11:38 <DIR> d-------- C:\Arquivos de programas\Norton Security Scan 2007-09-06 11:37 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\Google Updater 2007-09-06 11:31 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-09-06 11:09 <DIR> d-------- C:\Arquivos de programas\Lavasoft 2007-09-05 13:30 <DIR> d-------- C:\Arquivos de programas\Dynamic 2007-09-05 12:43 894,702 --a------ C:\WINDOWS\ds2eng5.dat 2007-09-05 12:43 86,832 --a------ C:\WINDOWS\ds2engm.dat 2007-09-05 12:43 74,685 --a------ C:\WINDOWS\dwreng4.dat 2007-09-05 12:43 211,830 --a------ C:\WINDOWS\catdws.dat 2007-09-05 07:53 8 --a------ C:\WINDOWS\system32\43edfea4.dat 2007-09-04 18:17 <DIR> d-------- C:\Arquivos de programas\SEO Studio 2007-09-04 18:17 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Wise Installation Wizard 2007-09-04 16:09 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\DADOSD~1\m 2007-09-04 16:05 941,568 --a------ C:\WINDOWS\system32\semtempl.dll 2007-09-04 16:05 343,040 --a------ C:\WINDOWS\system32\arcdll.dll 2007-09-04 16:05 3,072 --a------ C:\WINDOWS\system32\hashfunc.dll 2007-09-04 16:05 25,600 --a------ C:\WINDOWS\system32\BORLNDMM.DLL 2007-09-04 16:05 219,648 --a------ C:\WINDOWS\system32\cg32.dll 2007-09-04 16:05 1,496,064 --a------ C:\WINDOWS\system32\cc3250mt.dll 2007-09-04 16:05 <DIR> d-------- C:\Arquivos de programas\seoadministrator 2007-09-04 14:16 <DIR> d-------- C:\DOCUME~1\ADMINI~1\DADOSD~1\eMule 2007-09-04 11:15 <DIR> d-------- C:\Arquivos de programas\NetPromoter 2007-09-04 10:14 <DIR> d-------- C:\DOCUME~1\ADMINI~1\DADOSD~1\Good Keywords v2 2007-09-04 09:45 46,056 --a------ C:\WINDOWS\dkbeng.dat 2007-09-04 09:45 221,184 --a------ C:\WINDOWS\system32\DartSock.dll 2007-09-04 09:45 118,784 --a------ C:\WINDOWS\system32\DartWeb.dll 2007-08-30 12:41 <DIR> d-------- C:\Nova pasta 2007-08-28 20:38 73,216 --a------ C:\WINDOWS\cadkasdeinst01s.exe 2007-08-28 20:38 <DIR> d-------- C:\Arquivos de programas\PDF Editor 2 2007-08-28 19:41 <DIR> d-------- C:\DOCUME~1\ADMINI~1\DADOSD~1\pdf995 2007-08-28 19:40 51,716 --a------ C:\WINDOWS\system32\pdf995mon.dll 2007-08-28 19:40 249,856 --a------ C:\WINDOWS\system32\pdfmona.dll 2007-08-28 19:40 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\pdf995 2007-08-28 19:40 <DIR> d-------- C:\Arquivos de programas\pdf995 2007-08-25 17:26 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\FLEXnet 2007-08-25 17:20 <DIR> d-------- C:\Arquivos de programas\Bonjour 2007-08-25 17:08 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Macrovision Shared 2007-08-24 19:40 <DIR> d--h----- C:\WINDOWS\PIF 2007-08-22 08:45 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2007-08-22 08:45 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2007-08-21 16:09 <DIR> d-------- C:\DOCUME~1\ADMINI~1\DADOSD~1\Joost 2007-08-21 12:50 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2007-08-21 12:50 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2007-08-21 11:17 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\WLInstaller 2007-08-21 11:17 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\WindowsLiveInstaller 2007-08-21 11:17 <DIR> d-------- C:\Arquivos de programas\Windows Live 2007-08-13 11:02 <DIR> d-------- C:\Arquivos de programas\GbPlugin 2007-08-13 10:58 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\GbPlugin (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) )) 2007-09-07 00:02 --------- d-------- C:\DOCUME~1\ADMINI~1\DADOSD~1\Skype 2007-09-07 00:01 --------- d-------- C:\Arquivos de programas\Steam 2007-09-06 14:18 --------- d-------- C:\Arquivos de programas\SmartFTP 2007-09-06 11:37 --------- d-------- C:\Arquivos de programas\Google 2007-09-05 17:36 --------- d--h----- C:\Arquivos de programas\InstallShield Installation Information 2007-09-05 11:41 --------- d-------- C:\Arquivos de programas\TRELLIAN 2007-09-04 14:16 --------- d-------- C:\Arquivos de programas\eMule 2007-08-30 10:12 --------- d-------- C:\DOCUME~1\ADMINI~1\DADOSD~1\LimeWire 2007-08-21 11:25 --------- d-------- C:\Arquivos de programas\MSN Messenger 2007-08-07 10:35 --------- d-------- C:\Arquivos de programas\KAIZEN Games 2007-08-06 09:44 --------- d-------- C:\DOCUME~1\ADMINI~1\DADOSD~1\TextPad 2007-08-03 11:25 --------- d-------- C:\DOCUME~1\ADMINI~1\DADOSD~1\SecondLife 2007-08-03 10:59 --------- d-------- C:\Arquivos de programas\NKProds 2007-08-02 09:57 --------- d-------- C:\Arquivos de programas\Windows Live Safety Center 2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll 2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll 2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll 2007-07-30 09:05 --------- d-------- C:\Arquivos de programas\Workspace Macro Pro 6.0 2007-07-29 22:10 --------- d-------- C:\Arquivos de programas\Workspace Macro Pro 6.5 2007-07-29 21:44 --------- d-------- C:\Arquivos de programas\Launch-n-Go 2007-07-29 09:39 --------- d-------- C:\Arquivos de programas\Macro Express3 2007-07-28 10:33 --------- d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\Macro Mania 2007-07-28 09:25 --------- d-------- C:\Arquivos de programas\ShortKeys2 2007-07-28 00:32 --------- d-------- C:\Arquivos de programas\iMacros 2007-07-28 00:28 --------- d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\Insight Software Solutions 2007-07-28 00:23 --------- d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\iOpus-i-M 2007-07-28 00:20 --------- d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\Insight Software 2007-07-27 22:29 --------- d-------- C:\Arquivos de programas\AutoIt3 2007-07-27 19:07 783224 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-07-27 19:02 94416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-07-27 19:02 92848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-07-27 19:00 23152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-07-27 18:59 42912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-07-27 18:58 26624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-07-27 18:57 95608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-07-14 20:26 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-07-14 20:25 --------- d-------- C:\DOCUME~1\ADMINI~1\DADOSD~1\Leadertech 2007-07-14 20:14 --------- d-------- C:\Arquivos de programas\Atari 2007-07-14 19:58 --------- d-------- C:\Arquivos de programas\CureROM 2007-07-14 19:42 --------- d-------- C:\Arquivos de programas\Walker Brothers 2007-07-14 19:26 --------- d-------- C:\Arquivos de programas\arniWORX 2007-06-29 01:54 356352 --a------ C:\WINDOWS\system32\NVUNINST.EXE 2007-06-29 01:54 356352 --a------ C:\WINDOWS\system32\nvudisp.exe 2007-06-29 00:43 8466432 --a------ C:\WINDOWS\system32\nvcpl.dll 2007-06-29 00:43 81920 --a------ C:\WINDOWS\system32\nvwddi.dll 2007-06-29 00:43 81920 --a------ C:\WINDOWS\system32\nvmctray.dll 2007-06-29 00:43 753664 --a------ C:\WINDOWS\system32\nvcplui.exe 2007-06-29 00:43 6729728 --a------ C:\WINDOWS\system32\nvoglnt.dll 2007-06-29 00:43 6234112 --a------ C:\WINDOWS\system32\nvdisps.dll 2007-06-29 00:43 5690624 --a------ C:\WINDOWS\system32\nv4_disp.dll 2007-06-29 00:43 5455872 --a------ C:\WINDOWS\system32\nvdispsr.dll 2007-06-29 00:43 458752 --a------ C:\WINDOWS\system32\nvmccssr.dll 2007-06-29 00:43 37376 --a------ C:\WINDOWS\system32\nvcodins.dll 2007-06-29 00:43 37376 --a------ C:\WINDOWS\system32\nvcod.dll 2007-06-29 00:43 360448 --a------ C:\WINDOWS\system32\nvapi.dll 2007-06-29 00:43 3600384 --a------ C:\WINDOWS\system32\nvvitvsr.dll 2007-06-29 00:43 3518464 --a------ C:\WINDOWS\system32\nvvitvs.dll 2007-06-29 00:43 3321856 --a------ C:\WINDOWS\system32\nvgames.dll 2007-06-29 00:43 3072000 --a------ C:\WINDOWS\system32\nvgamesr.dll 2007-06-29 00:43 307200 --a------ C:\WINDOWS\system32\nvexpbar.dll 2007-06-29 00:43 286720 --a------ C:\WINDOWS\system32\nvnt4cpl.dll 2007-06-29 00:43 2854912 --a------ C:\WINDOWS\system32\nvmoblsr.dll 2007-06-29 00:43 2416640 --a------ C:\WINDOWS\system32\nvwssr.dll 2007-06-29 00:43 2330624 --a------ C:\WINDOWS\system32\nvwss.dll 2007-06-29 00:43 229376 --a------ C:\WINDOWS\system32\nvmccs.dll 2007-06-29 00:43 188416 --a------ C:\WINDOWS\system32\nvmccss.dll 2007-06-29 00:43 155716 --a------ C:\WINDOWS\system32\nvsvc32.exe 2007-06-29 00:43 1142784 --a------ C:\WINDOWS\system32\nvmobls.dll 2007-06-29 00:43 1073152 --a------ C:\WINDOWS\system32\nvcpluir.dll 2007-06-29 00:43 1018772 --a------ C:\WINDOWS\system32\nvucode.bin 2007-06-27 10:42 2560 --a------ C:\WINDOWS\system32\bitcometres.dll 2007-06-27 10:05 359808 --a------ C:\WINDOWS\system32\dllcache\tcpip.sys 2007-03-13 19:12 818176 --a------ C:\DOCUME~1\ALLUSE~1\DADOSD~1\services.exe 2007-03-13 19:12 688128 --a------ C:\DOCUME~1\ALLUSE~1\DADOSD~1\libeay32.dll 2007-03-13 19:12 155648 --a------ C:\DOCUME~1\ALLUSE~1\DADOSD~1\ssleay32.dll 2007-03-13 19:12 15360 --a------ C:\DOCUME~1\ALLUSE~1\DADOSD~1\msdtkysx.dll 2007-02-26 11:23 673546 --a------ C:\DOCUME~1\ADMINI~1\DADOSD~1\unins000.exe 2001-11-23 11:08 712704 --a------ C:\WINDOWS\inf\OTHER\AUDIO3D.DLL ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run] "SunJavaUpdateSched"="C:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86 \3\hpztsb04.exe" [2001-10-12 07:18] "HP Software Update"="C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 12:38] "HP Component Manager"="C:\Arquivos de programas\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 14:18] "Skype@phone"="C:\Arquivos de programas\Skype@phone\Skype@phone.exe" [2005-04-08 15:40] "EasyMessage"="C:\Arquivos de programas\Easy Messenger\em2.exe" [] "NeroFilterCheck"="C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe" [2005-07-17 06:04] "avast!"="C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp. exe" [] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43] "nwiz"="nwiz.exe" [2006-03-09 15:29 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray. dll" [2007-06-29 00:43] "Acrobat Assistant 8.0"="C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-22 23:24] "AAWTray"="C:\Arquivos de programas\Lavasoft\Ad-Aware 2007\AAWTray.exe" [] "SDTray"="C:\Arquivos de programas\Spyware Doctor\SDTrayApp.exe" [] "!AVG Anti-Spyware"="C:\Arquivos de programas\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-09-06 13:16] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run] "MsnMsgr"="C:\Arquivos de programas\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54] "swg"="C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolb arNotifier.exe" [2005-07-17 06:04] "Skype"="C:\Arquivos de programas\Skype\Phone\Skype.exe" [2007-01-12 12:57] "Steam"="c:\arquivos de programas\steam\steam.exe" [2007-06-28 07:16] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 18:04] "H/PC Connection Agent"="C:\Arquivos de programas\Microsoft ActiveSync\wcescomm.exe" [2006-06-26 23:38] "mule_st_key"="C:\Documents and Settings\Administrador\Dados de aplicativos\m\flec006.exe" [2007-09-06 21:10] "SpybotSD TeaTimer"="C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe" [] C:\DOCUME~1\ADMINI~1\MENUIN~1\PROGRA~1\INICIA~1\ Adobe Gamma.lnk - C:\Arquivos de programas\Arquivos comuns\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 18:16:50] [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\explorer] "ForceClassicControlPanel"=1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\policies\explorer] "NoSharedDocuments"=1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\cur rentversion\policies\explorer] "NoSharedDocuments"=1 (0x1) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\ShellExecuteHooks] "{E37CB5F0-51F5-4395-A808-5FA49E399003}"= C:\Arquivos de programas\GbPlugin\gbiehcef.dll [2007-07-12 14:54 322120] SafeBoot registry key needs repairs. This machine cannot enter Safe Mode. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\File system] @="Driver Group" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\RpcSs] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\vgasave.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}] @="DiskDrive" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}] @="Hdc" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}] @="Keyboard" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}] @="Mouse" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}] @="System" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}] @="Volume" R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viam raid.sys R2 GbpSv;Gbp Service;C:\Arquivos de programas\GbPlugin\GbpSv.exe S1 srosa;Megadrv3;\??\C:\WINDOWS\system32\drivers\sro sa.sys S3 s3chipid;s3chipid;\??\C:\DOCUME~1\ADMINI~1\CONFIG~ 1\Temp\s3chipid.sys Contents of the 'Scheduled Tasks' folder 2007-09-06 14:38:09 C:\WINDOWS\Tasks\Norton Security Scan.job - C:\Arquivos de programas\Norton Security Scan\Nss.exe 2007-08-18 03:35:00 C:\WINDOWS\Tasks\WebReg 20070124003529.job - C:\Arquivos de programas\HP\Digital Imaging\bin\hpqwrg.exe ************************************************** ************************ catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-07 00:00:32 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************** ************************ Completion time: 2007-09-07 0:07:04 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-09-07 00:06 --- E O F --- Compartilhar este post Link para o post Compartilhar em outros sites
jgarcia 1 Denunciar post Postado Setembro 10, 2007 Opa nanaok, Siga as instruções deste tutorial e retorne com o resultado. Poste ainda um novo log do ComboFix, que somente deve ser executado após a utilização do EliBaglA. Abraços. Compartilhar este post Link para o post Compartilhar em outros sites
nanaok 0 Denunciar post Postado Setembro 10, 2007 olá...segue log do Elibagle Mon Sep 10 15:15:09 2007 EliBagle v10.51 ©2007 S.G.H. / Satinfo S.L. ---------------------------------------------- Lista de Acciones (por Acción Directa): C:\DOCUMENTS AND SETTINGS\ADMINISTRADOR\DADOS DE APLICATIVOS\M\FLEC006.EXE --> Bagle.dldr Renombrado a .VIR C:\DOCUMENTS AND SETTINGS\ADMINISTRADOR\DADOS DE APLICATIVOS\M\LIST.OCT --> Eliminado Bagle Mon Sep 10 15:15:43 2007 EliBagle v10.51 ©2007 S.G.H. / Satinfo S.L. ---------------------------------------------- Lista de Acciones (por Exploración): Explorando Unidad C:\ C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NEROCHECK.EXE --> Eliminado Bagle C:\Arquivos de programas\Google\GoogleToolbarNotifier\GOOGLETOOLBARNOTIFIER.EXE --> Eliminado Bagle C:\Documents and Settings\Administrador\Dados de aplicativos\m\FLEC006.EXE.VIR --> Eliminado Bagle.dldr C:\Documents and Settings\Administrador\Meus documentos\eMule Downloads\Incoming\CYBERFETCH WEBSITE SUBMITTER 2.0.5 KEY+SERIAL.ZIP --> Eliminado Bagle C:\Documents and Settings\Administrador\Meus documentos\eMule Downloads\Incoming\GSA AUTO WEBSITE SUBMITTER 2.13.ZIP --> Eliminado Bagle.dldr C:\Documents and Settings\Administrador\Meus documentos\eMule Downloads\Incoming\PAGE PROMOTER 7.0.ZIP --> Eliminado Bagle C:\Documents and Settings\Administrador\Meus documentos\eMule Downloads\Incoming\SEO ADMINISTRATOR 3.6 KEYGEN.ZIP --> Eliminado Bagle C:\Documents and Settings\Administrador\Meus documentos\eMule Downloads\Incoming\WEB OPTIMIZATION EASY 4.0 [KEYGEN].ZIP --> Eliminado Bagle C:\Documents and Settings\Administrador\Meus documentos\eMule Downloads\Incoming\WEB OPTIMIZATION EASY PRO 4.20 [KEY].ZIP --> Eliminado Bagle C:\Downloads\otimização\CYBERFETCH WEBSITE SUBMITTER 2.0.5 KEY+SERIAL.EXE --> Eliminado Bagle C:\Downloads\otimização\SEO ADMINISTRATOR 3.6 KEYGEN.EXE --> Eliminado Bagle C:\programas para pda\Windows Mobile\MXCALC 12C 1.2.ZIP --> Eliminado Bagle.dldr C:\Programas Pocket e Palm\Calculadoras\MXCALC 12C 1.2.ZIP --> Eliminado Bagle.dldr C:\Programas Pocket e Palm\Windows Mobile\MXCALC 12C 1.2.ZIP --> Eliminado Bagle.dldr C:\qoobox\Quarantine\C\WINDOWS\exefld\127109.EXE.VIR --> Eliminado Bagle.dldr C:\qoobox\Quarantine\C\WINDOWS\exefld\14657765.EXE.VIR --> Eliminado Bagle.dldr C:\qoobox\Quarantine\C\WINDOWS\exefld\1655593.EXE.VIR --> Eliminado Bagle.dldr C:\qoobox\Quarantine\C\WINDOWS\exefld\21254359.EXE.VIR --> Eliminado Bagle.dldr C:\qoobox\Quarantine\C\WINDOWS\exefld\217562.EXE.VIR --> Eliminado Bagle.dldr C:\qoobox\Quarantine\C\WINDOWS\exefld\238203.EXE.VIR --> Eliminado Bagle.dldr C:\qoobox\Quarantine\C\WINDOWS\exefld\28751375.EXE.VIR --> Eliminado Bagle.dldr C:\qoobox\Quarantine\C\WINDOWS\exefld\29122343.EXE.VIR --> Eliminado Bagle.dldr C:\qoobox\Quarantine\C\WINDOWS\exefld\36102671.EXE.VIR --> Eliminado Bagle.dldr C:\qoobox\Quarantine\C\WINDOWS\exefld\43161046.EXE.VIR --> Eliminado Bagle.dldr C:\qoobox\Quarantine\C\WINDOWS\exefld\50509218.EXE.VIR --> Eliminado Bagle.dldr C:\qoobox\Quarantine\C\WINDOWS\exefld\6841671.EXE.VIR --> Eliminado Bagle.dldr C:\qoobox\Quarantine\C\WINDOWS\system32\drivers\HIDR.EXE.VIR --> Eliminado Bagle Segue log do combofix ComboFix 07-09-10.6 - "Administrador" 2007-09-10 15:33:02.2 - NTFS x86 Microsoft Windows XP Professional 5.1.2600.2.1252.55.1046.18.93 [GMT -3:00] C:\WINDOWS\system32\chkdsk.exe está faltando * Created a new restore point . ((((((((((((((((((((((((((((((((((((( Outras Exclusões ))))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Arquivos de programas\gbplugin\Cef.gpc C:\Arquivos de programas\gbplugin\Cef.gpc . . . . falha na exclusão C:\Arquivos de programas\gbplugin\gbieh.gmd C:\DOCUME~1\ADMINI~1\DADOSD~1\unins000.exe C:\DOCUME~1\ALLUSE~1\DADOSD~1\libeay32.dll C:\DOCUME~1\ALLUSE~1\DADOSD~1\ssleay32.dll ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_SROSA -------\srosa ((((((((((((((((((((((( Ficheiros criados de 2007-08-10 to 2007-09-10 )))))))))))))))))))))))))))))))) . 2007-09-07 13:41 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Skype 2007-09-06 23:52 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-09-06 13:12 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\Spybot - Search & Destroy 2007-09-06 12:08 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-09-06 12:07 82,248 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-09-06 12:07 57,672 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-09-06 12:07 40,264 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-09-06 12:07 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-09-06 12:06 <DIR> d-------- C:\DOCUME~1\ADMINI~1\DADOSD~1\PC Tools 2007-09-06 11:52 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Symantec Shared 2007-09-06 11:48 <DIR> d-------- C:\Arquivos de programas\Spyware Doctor 2007-09-06 11:40 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-09-06 11:38 <DIR> d-------- C:\Arquivos de programas\Norton Security Scan 2007-09-06 11:37 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\Google Updater 2007-09-06 11:31 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-09-06 11:09 <DIR> d-------- C:\Arquivos de programas\Lavasoft 2007-09-05 13:30 <DIR> d-------- C:\Arquivos de programas\Dynamic 2007-09-05 12:43 894,702 --a------ C:\WINDOWS\ds2eng5.dat 2007-09-05 12:43 86,832 --a------ C:\WINDOWS\ds2engm.dat 2007-09-05 12:43 74,685 --a------ C:\WINDOWS\dwreng4.dat 2007-09-05 12:43 211,830 --a------ C:\WINDOWS\catdws.dat 2007-09-05 07:53 8 --a------ C:\WINDOWS\system32\43edfea4.dat 2007-09-04 18:17 <DIR> d-------- C:\Arquivos de programas\SEO Studio 2007-09-04 18:17 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Wise Installation Wizard 2007-09-04 16:09 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\DADOSD~1\m 2007-09-04 16:05 941,568 --a------ C:\WINDOWS\system32\semtempl.dll 2007-09-04 16:05 343,040 --a------ C:\WINDOWS\system32\arcdll.dll 2007-09-04 16:05 3,072 --a------ C:\WINDOWS\system32\hashfunc.dll 2007-09-04 16:05 25,600 --a------ C:\WINDOWS\system32\BORLNDMM.DLL 2007-09-04 16:05 219,648 --a------ C:\WINDOWS\system32\cg32.dll 2007-09-04 16:05 1,496,064 --a------ C:\WINDOWS\system32\cc3250mt.dll 2007-09-04 16:05 <DIR> d-------- C:\Arquivos de programas\seoadministrator 2007-09-04 14:16 <DIR> d-------- C:\DOCUME~1\ADMINI~1\DADOSD~1\eMule 2007-09-04 11:15 <DIR> d-------- C:\Arquivos de programas\NetPromoter 2007-09-04 10:14 <DIR> d-------- C:\DOCUME~1\ADMINI~1\DADOSD~1\Good Keywords v2 2007-09-04 09:45 46,056 --a------ C:\WINDOWS\dkbeng.dat 2007-09-04 09:45 221,184 --a------ C:\WINDOWS\system32\DartSock.dll 2007-09-04 09:45 118,784 --a------ C:\WINDOWS\system32\DartWeb.dll 2007-08-30 12:41 <DIR> d-------- C:\Nova pasta 2007-08-28 20:38 73,216 --a------ C:\WINDOWS\cadkasdeinst01s.exe 2007-08-28 20:38 <DIR> d-------- C:\Arquivos de programas\PDF Editor 2 2007-08-28 19:41 <DIR> d-------- C:\DOCUME~1\ADMINI~1\DADOSD~1\pdf995 2007-08-28 19:40 51,716 --a------ C:\WINDOWS\system32\pdf995mon.dll 2007-08-28 19:40 249,856 --a------ C:\WINDOWS\system32\pdfmona.dll 2007-08-28 19:40 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\pdf995 2007-08-28 19:40 <DIR> d-------- C:\Arquivos de programas\pdf995 2007-08-25 17:26 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\FLEXnet 2007-08-25 17:20 <DIR> d-------- C:\Arquivos de programas\Bonjour 2007-08-25 17:08 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Macrovision Shared 2007-08-24 19:40 <DIR> d--h----- C:\WINDOWS\PIF 2007-08-22 08:45 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2007-08-22 08:45 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2007-08-21 16:09 <DIR> d-------- C:\DOCUME~1\ADMINI~1\DADOSD~1\Joost 2007-08-21 12:50 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2007-08-21 12:50 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2007-08-21 11:17 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\WLInstaller 2007-08-21 11:17 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\WindowsLiveInstaller 2007-08-21 11:17 <DIR> d-------- C:\Arquivos de programas\Windows Live 2007-08-13 11:02 <DIR> d-------- C:\Arquivos de programas\GbPlugin 2007-08-13 10:58 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\GbPlugin . ((((((((((((((((((((((((((((((((((((( Relatório Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-09-10 08:06 --------- d-------- C:\DOCUME~1\ADMINI~1\DADOSD~1\Skype 2007-09-10 08:04 --------- d-------- C:\Arquivos de programas\Steam 2007-09-08 19:01 --------- d-------- C:\DOCUME~1\CONVID~1\DADOSD~1\Ahead 2007-09-07 13:41 --------- d-------- C:\Arquivos de programas\Skype 2007-09-06 14:18 --------- d-------- C:\Arquivos de programas\SmartFTP 2007-09-06 11:37 --------- d-------- C:\Arquivos de programas\Google 2007-09-05 17:36 --------- d--h----- C:\Arquivos de programas\InstallShield Installation Information 2007-09-05 11:41 --------- d-------- C:\Arquivos de programas\TRELLIAN 2007-09-04 14:16 --------- d-------- C:\Arquivos de programas\eMule 2007-08-30 10:12 --------- d-------- C:\DOCUME~1\ADMINI~1\DADOSD~1\LimeWire 2007-08-21 11:25 --------- d-------- C:\Arquivos de programas\MSN Messenger 2007-08-07 10:35 --------- d-------- C:\Arquivos de programas\KAIZEN Games 2007-08-06 09:44 --------- d-------- C:\DOCUME~1\ADMINI~1\DADOSD~1\TextPad 2007-08-03 11:25 --------- d-------- C:\DOCUME~1\ADMINI~1\DADOSD~1\SecondLife 2007-08-03 10:59 --------- d-------- C:\Arquivos de programas\NKProds 2007-08-02 09:57 --------- d-------- C:\Arquivos de programas\Windows Live Safety Center 2007-07-30 09:05 --------- d-------- C:\Arquivos de programas\Workspace Macro Pro 6.0 2007-07-29 22:10 --------- d-------- C:\Arquivos de programas\Workspace Macro Pro 6.5 2007-07-29 21:44 --------- d-------- C:\Arquivos de programas\Launch-n-Go 2007-07-29 09:39 --------- d-------- C:\Arquivos de programas\Macro Express3 2007-07-28 10:33 --------- d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\Macro Mania 2007-07-28 09:25 --------- d-------- C:\Arquivos de programas\ShortKeys2 2007-07-28 00:32 --------- d-------- C:\Arquivos de programas\iMacros 2007-07-28 00:28 --------- d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\Insight Software Solutions 2007-07-28 00:23 --------- d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\iOpus-i-M 2007-07-28 00:20 --------- d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\Insight Software 2007-07-27 22:29 --------- d-------- C:\Arquivos de programas\AutoIt3 2007-07-27 19:02 94416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-07-27 19:02 92848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-07-27 19:00 23152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-07-27 18:59 42912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-07-27 18:58 26624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-07-14 20:25 --------- d-------- C:\DOCUME~1\ADMINI~1\DADOSD~1\Leadertech 2007-07-14 20:14 --------- d-------- C:\Arquivos de programas\Atari 2007-07-14 19:58 --------- d-------- C:\Arquivos de programas\CureROM 2007-07-14 19:42 --------- d-------- C:\Arquivos de programas\Walker Brothers 2007-07-14 19:26 --------- d-------- C:\Arquivos de programas\arniWORX 2007-03-13 19:12 818176 --a------ C:\DOCUME~1\ALLUSE~1\DADOSD~1\services.exe 2007-03-13 19:12 15360 --a------ C:\DOCUME~1\ALLUSE~1\DADOSD~1\msdtkysx.dll 2001-11-23 11:08 712704 --a------ C:\WINDOWS\inf\OTHER\AUDIO3D.DLL . ((((((((((((((((((((((((((((( snapshot_2007-09-07_ 00431.79 ))))))))))))))))))))))))))))))))))))))))) . ----a-w 52,764 2007-09-07 03:05:18 C:\WINDOWS\system32\perfc009.dat ----a-w 61,400 2007-09-07 03:05:18 C:\WINDOWS\system32\perfc016.dat ----a-w 380,350 2007-09-07 03:05:18 C:\WINDOWS\system32\perfh009.dat ----a-w 413,126 2007-09-07 03:05:19 C:\WINDOWS\system32\perfh016.dat ----a-w 16,384 2007-09-07 16:40:24 C:\WINDOWS\system32\config\systemprofile\Configurações locais\Histórico\History.IE5\index.dat ----a-w 32,768 2007-09-07 16:40:24 C:\WINDOWS\system32\config\systemprofile\Configurações locais\Temporary Internet Files\Content.IE5\index.dat ----a-w 32,768 2007-09-07 16:40:31 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat . ----a-w 52,764 2007-09-06 14:49:52 C:\WINDOWS\system32\perfc009.dat ----a-w 61,400 2007-09-06 14:49:52 C:\WINDOWS\system32\perfc016.dat ----a-w 380,350 2007-09-06 14:49:52 C:\WINDOWS\system32\perfh009.dat ----a-w 413,126 2007-09-06 14:49:52 C:\WINDOWS\system32\perfh016.dat ----a-w 16,384 2007-01-23 18:15:17 C:\WINDOWS\system32\config\systemprofile\Configurações locais\Histórico\History.IE5\index.dat ----a-w 32,768 2007-01-23 20:25:58 C:\WINDOWS\system32\config\systemprofile\Configurações locais\Temporary Internet Files\Content.IE5\index.dat ----a-w 16,384 2007-01-23 18:15:17 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat . (((((((((((((((((((((((((( Pontos de Carregamento do Registro ))))))))))))))))))))))))))))))))))))))) . *Nota* entradas vazias & legítimas por defeito não são mostradas. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-10-12 07:18] "HP Software Update"="C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 12:38] "HP Component Manager"="C:\Arquivos de programas\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 14:18] "Skype@phone"="C:\Arquivos de programas\Skype@phone\Skype@phone.exe" [2005-04-08 15:40] "EasyMessage"="C:\Arquivos de programas\Easy Messenger\em2.exe" [] "NeroFilterCheck"="C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe" [] "avast!"="C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe" [] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43] "nwiz"="nwiz.exe" [2006-03-09 15:29 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-29 00:43] "Acrobat Assistant 8.0"="C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-22 23:24] "AAWTray"="C:\Arquivos de programas\Lavasoft\Ad-Aware 2007\AAWTray.exe" [] "SDTray"="C:\Arquivos de programas\Spyware Doctor\SDTrayApp.exe" [2007-08-14 17:02] "!AVG Anti-Spyware"="C:\Arquivos de programas\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-09-06 13:16] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Arquivos de programas\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54] "swg"="C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [] "Skype"="C:\Arquivos de programas\Skype\Phone\Skype.exe" [2007-05-11 13:20] "Steam"="c:\arquivos de programas\steam\steam.exe" [2007-06-28 07:16] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 18:04] "H/PC Connection Agent"="C:\Arquivos de programas\Microsoft ActiveSync\wcescomm.exe" [2006-06-26 23:38] "SpybotSD TeaTimer"="C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe" [] C:\DOCUME~1\ALLUSE~1\MENUIN~1\PROGRA~1\INICIA~1\ Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe [2007-08-29 11:35:28] Adobe Acrobat Synchronizer.lnk - C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [2006-10-23 00:01:50] Google Updater.lnk - C:\Arquivos de programas\Google\Google Updater\GoogleUpdater.exe [2007-09-06 11:37:16] HP Digital Imaging Monitor.lnk - C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 21:31:38] Inicializa‡Æo r pida do HP Image Zone.lnk - C:\Arquivos de programas\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-28 22:06:36] Workspace Macro Pro Hotkeys.lnk - C:\Arquivos de programas\Workspace Macro Pro 6.5\WMPHotkeys.exe [2007-03-04 20:40:06] C:\DOCUME~1\ADMINI~1\MENUIN~1\PROGRA~1\INICIA~1\ Adobe Gamma.lnk - C:\Arquivos de programas\Arquivos comuns\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 18:16:50] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"=1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSharedDocuments"=1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSharedDocuments"=1 (0x1) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{E37CB5F0-51F5-4395-A808-5FA49E399003}"= C:\Arquivos de programas\GbPlugin\gbiehcef.dll [2007-07-12 14:54 322120] SafeBoot registry key needs repairs. This machine cannot enter Safe Mode. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system] @="Driver Group" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}] @="DiskDrive" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}] @="Hdc" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}] @="Keyboard" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}] @="Mouse" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}] @="System" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}] @="Volume" R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys R2 GbpSv;Gbp Service;C:\Arquivos de programas\GbPlugin\GbpSv.exe S3 s3chipid;s3chipid;\??\C:\DOCUME~1\ADMINI~1\CONFIG~1\Temp\s3chipid.sys . Conteúdo da pasta 'Tarefas Agendadas' "2007-09-06 14:38:09 C:\WINDOWS\Tasks\Norton Security Scan.job" - C:\Arquivos de programas\Norton Security Scan\Nss.exe "2007-08-18 03:35:00 C:\WINDOWS\Tasks\WebReg 20070124003529.job" - C:\Arquivos de programas\HP\Digital Imaging\bin\hpqwrg.exe . ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-10 15:42:15 Windows 5.1.2600 Service Pack 2 NTFS detected NTDLL code modification: ZwClose scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** . Completion time: 2007-09-10 15:45:31 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-09-10 15:44 C:\ComboFix2.txt ... 2007-09-07 00:07 . --- E O F --- Compartilhar este post Link para o post Compartilhar em outros sites
jgarcia 1 Denunciar post Postado Setembro 10, 2007 Opa nanaok, Baixe o F-Secure Blacklight em: F-Secure Blacklight Salve-o em sua área de trabalho (desktop) e o execute. Aceite o acordo. Clique em Scan e aguarde. Se ele encontrar algum arquivo, ignore, pois quero apenas o log. Ao final do scan será gerado o arquivo fsbl-xxxxx.log (onde xxx são números). Preciso que você copie o log e poste em sua próxima resposta. Abraços. Compartilhar este post Link para o post Compartilhar em outros sites
nanaok 0 Denunciar post Postado Setembro 10, 2007 Olá,Agradeço sua atençãoSegue o log09/10/07 16:26:22 [info]: BlackLight Engine 1.0.64 initialized09/10/07 16:26:22 [info]: OS: 5.1 build 2600 (Service Pack 2)09/10/07 16:26:22 [Note]: 7019 409/10/07 16:26:22 [Note]: 7005 009/10/07 16:26:27 [Note]: 7006 009/10/07 16:26:27 [Note]: 7011 172409/10/07 16:26:27 [Note]: 7026 009/10/07 16:26:27 [Note]: 7026 009/10/07 16:26:28 [Note]: FSRAW library version 1.7.102209/10/07 16:41:25 [Note]: 7007 0 Compartilhar este post Link para o post Compartilhar em outros sites
jgarcia 1 Denunciar post Postado Setembro 10, 2007 Opa nanaok, Execute o Active Scan da Panda, observando os seguintes procedimentos: 1) Alguns anti-vírus, tal como o AVAST, podem exibir um alerta de detecção durante a execução do scan, porém tal alerta deve ser ignorado. O aviso não passa de um falso-positivo. Sugiro que o AV seja desabilitado, temporariamente, a fim de que o scan ocorra sem problemas; 2) Para iniciar o processo, clique sobre o botão ; 3) Informe os dados solicitados no formulário; 4) Clique sobre o botão "Pesquise agora sem custos"; 5) Siga todas as instruções que lhe serão passadas e aguarde o fim da varredura; 6) Ao término do scan, clique em visualizar o log. Salve-o em seu Desktop; 7) Poste o conteúdo do log em sua próxima resposta. Abraços. Compartilhar este post Link para o post Compartilhar em outros sites
nanaok 0 Denunciar post Postado Setembro 11, 2007 segue logIncidência Estado Localização Virus:W32/Puce.F.worm Não desinfectado C:\Arquivos de programas\Alwil Software\Avast4\DATA\moved\Shania.Twain.-.Greatest.Hits.(Advance).2004.Ego.teste updated-fixed Release 07-2007.rar.vir[setup.exe] Adware:Adware/Pics-Factory Não desinfectado C:\Arquivos de programas\eMule\Incoming\Adobe Acrobat 8.0 KeyGen Crack (seed).rar[Adobe Acrobat 8.0 KeyGen Crack (seed).exe][zinserfolg.de.dll] Virus:Generic Trojan Não desinfectado C:\Arquivos de programas\eMule\Incoming\Apps - Workspace Macro Pro 6.5 with Crack.rar[Workspace Macro Pro.exe] Virus:W32/Puce.E.worm Desinfectado C:\Arquivos de programas\eMule\Incoming\Internet - Mail - Groupmail 5.0 updated-fixed 08-2006.zip[setup.exe] Ferramenta potencialmente indesejada:Application/ServUBased.A Não desinfectado C:\Arquivos de programas\eMule\Incoming\Serv-U FTP Server v6.1.0.1 Corporate Edition + Serial.rar[susetup.exe][sERVUDAEMON.EXE] Ferramenta potencialmente indesejada:Application/ServUBased.A Não desinfectado C:\Arquivos de programas\eMule\Incoming\Serv-U FTP Server v6.1.0.1 Corporate Edition + Serial.rar[susetup.exe][sERVUTRAY.EXE] Ferramenta potencialmente indesejada:Application/Servu.A Não desinfectado C:\Arquivos de programas\eMule\Incoming\Serv-U FTP Server v6.1.0.1 Corporate Edition + Serial.rar[susetup.exe][sERVUPERFCOUNT.DLL] Virus:Trj/Spyforms.AO Desinfectado C:\Arquivos de programas\eMule\Incoming\Submit It 2000 v3.0.zip[submit It 2000 v3.0.exe] Adware:Adware/InstaFinder Não desinfectado C:\Arquivos de programas\INSTAFINK\instafink.dll Virus:Generic Trojan Desinfectado C:\Arquivos de programas\Workspace Macro Pro 6.5\Workspace Macro Pro.exe Virus:Trj/Mitglieder.PP Desinfectado C:\Documents and Settings\Administrador\Configurações locais\Temporary Internet Files\Content.IE5\7U8BBPC5\mxd[1].jpg Virus:Trj/Mitglieder.PP Desinfectado C:\Documents and Settings\Administrador\Configurações locais\Temporary Internet Files\Content.IE5\7U8BBPC5\mxd[2].jpg Ferramenta potencialmente indesejada:Application/NirCmd.A Não desinfectado C:\Documents and Settings\Administrador\Configurações locais\Temporary Internet Files\Content.IE5\YL6L2P0B\ComboFix[1].exe[nircmd.exe] Spyware:Cookie/Com.com Não desinfectado C:\Documents and Settings\Administrador\Cookies\administrador@de.uol.com[1].txt Spyware:Cookie/Com.com Não desinfectado C:\Documents and Settings\Administrador\Cookies\administrador@ig.com[1].txt Spyware:Cookie/Searchportal Não desinfectado C:\Documents and Settings\Administrador\Cookies\administrador@searchportal.information[1].txt Spyware:Cookie/Com.com Não desinfectado C:\Documents and Settings\Administrador\Cookies\administrador@terra.com[1].txt Spyware:Cookie/Toplist Não desinfectado C:\Documents and Settings\Administrador\Cookies\administrador@toplist[1].txt Spyware:Cookie/Com.com Não desinfectado C:\Documents and Settings\Administrador\Cookies\administrador@uol.com[2].txt Virus:Trj/Downloader.FLQ Não desinfectado C:\Documents and Settings\Administrador\Meus documentos\eMule Downloads\Temp4.part[Active WebTraffic 7.0.0.4 Crack.exe] Virus:Trj/Jupillites.P Desinfectado C:\Documents and Settings\All Users\Dados de aplicativos\msdtkysx.dll Virus:Trj/Jupillites.P Desinfectado C:\Documents and Settings\Convidado\Configurações locais\Temp\odbccoin.tmp Adware:Adware/Cydoor Não desinfectado C:\Downloads.rar[Downloads\fgf150.exe] Virus:Generic Malware Não desinfectado C:\Downloads.rar[Downloads\Gordian.Knot.Rip.Pack.0.28.8.Setup.exe][GordianKnot.exe] Virus:Generic Malware Não desinfectado C:\Downloads.rar[Downloads\onlinedatingwebbrowser.exe] Ferramenta potencialmente indesejada:Application/NirCmd.A Não desinfectado C:\WINDOWS\nircmd.exe Adware:Adware/Aureate-Radiate Não desinfectado C:\WINDOWS\system32\GMAGlue.exe Compartilhar este post Link para o post Compartilhar em outros sites
jgarcia 1 Denunciar post Postado Setembro 11, 2007 Opa nanaok, Vamos lá. Habilite o Windows para mostrar todos os arquivos (até ocultos). 1ª Etapa Baixe o CCleaner em: CCleaner Baixe, mas não execute ainda. Baixe o Killbox em: Killbox 1. Execute o Killbox, clique em Delete on Reboot. 2. Copie a lista abaixo em negrito para a área de transferência. Selecione tudo com o auxílio do mouse --> vá até a aba Editar na barra do navegador --> clique em Copiar. C:\Arquivos de programas\Alwil Software\Avast4\DATA\moved\Shania.Twain.-.Greatest.Hits.(Advance).2004.Ego.teste updated-fixed Release 07-2007.rar.vir C:\Documents and Settings\Administrador\Meus documentos\eMule Downloads\Temp�4.part C:\Arquivos de programas\eMule\Incoming\Adobe Acrobat 8.0 KeyGen Crack (seed).rar C:\Arquivos de programas\eMule\Incoming\Apps - Workspace Macro Pro 6.5 with Crack.rar C:\Arquivos de programas\eMule\Incoming\Serv-U FTP Server v6.1.0.1 Corporate Edition + Serial.rar C:\Arquivos de programas\INSTAFINK\instafink.dll C:\WINDOWS\system32\GMAGlue.exe C:\Downloads.rar 3. Retorne ao Killbox. Clique em File > Paste from clipboard. Clique em All Files. 4. Aperte em "X". Responda "não" à pergunta. 2ª Etapa Reinicie em Modo Normal. Delete o conteúdo da seguinte pasta: C:\!Killbox Execute o CCleaner e clique em Executar Cleaner. Execute o Active Scan novamente e veja se ainda detecta algo. Aguardo retorno. Um abraço. Compartilhar este post Link para o post Compartilhar em outros sites
Sam Spade 2 Denunciar post Postado Março 21, 2008 Tópico Arquivado Como o autor não respondeu por mais de 20 dias, o tópico foi arquivado. Caso você seja o autor do tópico e quer reabrir, envie uma mensagem privada para um moderador da área juntamente com o link para este tópico e explique o motivo da reabertura. Compartilhar este post Link para o post Compartilhar em outros sites
