[Resolvido!]Problemas com perfil de usuário

President · Novembro 9, 2007

Olá, meu computador pessoal tem 5 perfis, mas de um tempo pra cá alguns deles começam a dar problema, não conectam direito ou ele conecta, mas todos os arquivos pessoais estão zerados. Eu sempre deletei o perfil e criei outro, mas agora além disso, o computador começou a ficar muito lento e a travar, gostaria de saber se poderiam me dar alguma informação sobre o que pode ser isso.

Já li alguns tópicos sobre malwares e invasões, vi que possuo alguns dos arquivos mencionados, decidi não mexer em nada para que possa ser feita uma análise mais completa, pois não adianta eu apagar um e deixar outro que vai criá-lo novamente.

Desde já agradeço pela ajuda.

O Log do HijackThis:

Logfile of HijackThis v1.99.1

Scan saved at 00:39:02, on 9/11/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

F:\WINDOWS\System32\smss.exe

F:\WINDOWS\system32\winlogon.exe

F:\WINDOWS\system32\services.exe

F:\WINDOWS\system32\lsass.exe

F:\WINDOWS\system32\svchost.exe

F:\WINDOWS\System32\svchost.exe

F:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

F:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

F:\Arquivos de programas\GbPlugin\GbpSv.exe

F:\WINDOWS\system32\spoolsv.exe

F:\WINDOWS\system32\svchost.exe

F:\WINDOWS\System32\svchost.exe

F:\WINDOWS\system32\svchost.exe

F:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

F:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

F:\WINDOWS\Explorer.EXE

F:\Arquivos de programas\DAEMON Tools\daemon.exe

F:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

F:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE

F:\Arquivos de programas\MSN Messenger\msnmsgr.exe

F:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WLLoginProxy.exe

F:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE

F:\Documents and Settings\Mummy\Desktop\Backup\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - F:\ARQUIV~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL

O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - F:\ARQUIV~1\MEGAUP~1\MEGAUP~1.DLL

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\Arquivos de programas\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Arquivos de programas\Java\jre1.5.0_09\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - F:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - F:\Arquivos de programas\GbPlugin\gbiehcef.dll

O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - F:\ARQUIV~1\MEGAUP~1\MEGAUP~1.DLL

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [DAEMON Tools] "F:\Arquivos de programas\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [avast!] F:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [sony Ericsson PC Suite] "H:\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

O4 - HKLM\..\Run: [RemoteControl] "F:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [QuickTime Task] "F:\Arquivos de programas\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NeroFilterCheck] F:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [LanguageShortcut] "F:\Arquivos de programas\CyberLink\PowerDVD\Language\Language.exe"

O4 - HKLM\..\Run: [iTunesHelper] "F:\Arquivos de programas\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [iSUSScheduler] "F:\Arquivos de programas\Arquivos comuns\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [iSUSPM Startup] "F:\Arquivos de programas\Arquivos comuns\InstallShield\UpdateService\isuspm.exe" -startup

O4 - HKLM\..\Run: [HP Software Update] F:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [Adobe Photo Downloader] "F:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [MSConfig] F:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKCU\..\Run: [swg] F:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [Picasa Media Detector] F:\Arquivos de programas\Picasa2\PicasaMediaDetector.exe

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "F:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [ares] "F:\Arquivos de programas\Ares\Ares.exe" -h

O4 - Global Startup: Adobe Gamma Loader.lnk = F:\Arquivos de programas\Arquivos comuns\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: AutoCAD Startup Accelerator.lnk = F:\Arquivos de programas\Arquivos comuns\Autodesk Shared\acstart16.exe

O4 - Global Startup: Google Updater.lnk = F:\Arquivos de programas\Google\Google Updater\GoogleUpdater.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = F:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

O8 - Extra context menu item: &Clean Traces - F:\Arquivos de programas\DAP\Privacy Package\dapcleanerie.htm

O8 - Extra context menu item: &Download with &DAP - F:\Arquivos de programas\DAP\dapextie.htm

O8 - Extra context menu item: Download &all with DAP - F:\Arquivos de programas\DAP\dapextie2.htm

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://F:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Arquivos de programas\Java\jre1.5.0_09\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Arquivos de programas\Java\jre1.5.0_09\bin\ssv.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - F:\ARQUIV~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL

O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://zone.msn.com/bingame/rtlw/default/R...bGameLoader.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/resources/MSNPUpld.cab

O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst...ctDetection.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399003} (GbPluginObj Class) - https://imagem.caixa.gov.br/cab/GbPluginCef.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - F:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - F:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - F:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - F:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - F:\ARQUIV~1\ARQUIV~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - F:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - F:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - F:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - F:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

jgarcia · Novembro 10, 2007

Opa President,

Vá em Iniciar -> Executar -> digite msconfig -> dê Ok -> aba Inicializar -> marque todas as caixas.

Feito isto poste um novo log.

Abraços.

President · Novembro 11, 2007

Eu fiz isso antes de postar esse log. Tinha visto vocês pedirem isso em outro tópico, então resolvi me adiantar...

Esse é o log com tudo marcado.

Obrigado

jgarcia · Novembro 12, 2007

Opa President,

Baixe o ComboFix em:

ComboFix

1) Dê um duplo-clique no combofix.exe e tecle "1" para prosseguir. O processo vai durar, em média, 10 minutos;

2) O ComboFix reiniciará o PC automaticamente, a fim de que o processo de remoção seja finalizado (somente se houver infecção);

3) Quando a varredura acabar, será gerado um log, que estará em F:\ComboFix.txt;

4) Não clique na janela do ComboFix, nem feche clicando no X, enquanto a ferramenta estiver sendo executada, pois isto implicará na desconfiguração de seu desktop (ele ficará todo branco);

5) Para parar ou sair do ComboFix, tecle "N";

6) Preciso que você cole o conteúdo do ComboFix.txt em sua próxima resposta, juntamente com um novo log do HijackThis.

Abraços.

President · Novembro 12, 2007

O log do Combofix

ComboFix 07-11-08.1 - Mummy 2007-11-12 17:30:42.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.169 [GMT -2:00]

Executando de: F:\Documents and Settings\Mummy\Desktop\ComboFix.exe

.

Incapaz de adquirir Privilégios de Sistema

((((((((((((((((((((((((((((((((((((( Outras Exclusäes )))))))))))))))))))))))))))))))))))))))))))))))))))

.

F:\Arquivos de programas\gbplugin\Cef.gpc

.

((((((((((((((((((((((( Ficheiros criados de 2007-10-12 to 2007-11-12 ))))))))))))))))))))))))))))))))

.

2007-11-12 15:37 <DIR> d-------- F:\WINDOWS\system32\config\systemprofile\Configurações locais

2007-11-12 15:37 <DIR> d-------- F:\Documents and Settings\Rafaela\Configurações locais

2007-11-12 15:37 <DIR> d-------- F:\Documents and Settings\Pappy\Configurações locais

2007-11-12 15:37 <DIR> d-------- F:\Documents and Settings\NetworkService\Configurações locais

2007-11-12 15:37 <DIR> d-------- F:\Documents and Settings\Mummy\Configurações locais

2007-11-12 15:37 <DIR> d-------- F:\Documents and Settings\mammy\Configurações locais

2007-11-12 15:37 <DIR> d-------- F:\Documents and Settings\LocalService\Configurações locais

2007-11-12 15:37 <DIR> d-------- F:\Documents and Settings\Default User\Configurações locais

2007-11-12 15:37 <DIR> d-------- F:\Documents and Settings\Administrador\Configurações locais

2007-11-12 13:36 51,200 --a------ F:\WINDOWS\NirCmd.exe

2007-10-30 02:29 <DIR> d-------- F:\Arquivos de programas\Arquivos comuns\SWF Studio

.

((((((((((((((((((((((((((((((((((((( Relat¢rio Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2007-11-12 19:36 --------- d-----w F:\Arquivos de programas\GbPlugin

2007-11-01 15:30 --------- d-----w F:\Documents and Settings\Mummy\Dados de aplicativos\Image Zone Express

2007-10-31 19:14 --------- d-----w F:\Documents and Settings\Mummy\Dados de aplicativos\MEGAUPLOADTOOLBAR

2007-10-27 21:58 --------- d-----w F:\Arquivos de programas\DecaCAD

2007-10-25 16:05 94,416 ----a-w F:\WINDOWS\system32\drivers\aswmon2.sys

2007-10-25 16:05 93,264 ----a-w F:\WINDOWS\system32\drivers\aswmon.sys

2007-10-25 16:03 23,152 ----a-w F:\WINDOWS\system32\drivers\aswRdr.sys

2007-10-25 16:01 42,912 ----a-w F:\WINDOWS\system32\drivers\aswTdi.sys

2007-10-25 15:58 26,624 ----a-w F:\WINDOWS\system32\drivers\aavmker4.sys

2007-10-25 15:24 815,480 ----a-w F:\WINDOWS\system32\aswBoot.exe

2007-10-25 15:14 95,608 ----a-w F:\WINDOWS\system32\AVASTSS.scr

2007-10-24 22:41 --------- d-----w F:\Documents and Settings\Pappy\Dados de aplicativos\MEGAUPLOADTOOLBAR

2007-10-16 19:44 --------- d-----w F:\Arquivos de programas\PokerStars

2007-10-10 14:08 --------- d-----w F:\Documents and Settings\Mummy\Dados de aplicativos\HP

2007-10-10 14:04 --------- d-----w F:\Documents and Settings\Mummy\Dados de aplicativos\Printer Info Cache

2007-10-10 13:37 --------- d-----w F:\Arquivos de programas\Google

2007-10-09 23:04 --------- d-----w F:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin

2007-10-09 04:30 --------- d-----w F:\Arquivos de programas\PhotoMix

2007-10-08 16:16 --------- d-----w F:\Documents and Settings\All Users\Dados de aplicativos\Messenger Plus!

2007-10-08 02:43 --------- d-----w F:\Arquivos de programas\Windows Live

2007-10-08 02:43 --------- d-----w F:\Arquivos de programas\MSN Messenger

2007-10-08 02:43 --------- d-----w F:\Arquivos de programas\Messenger Plus! Live

2007-10-07 23:54 --------- d-----w F:\Documents and Settings\All Users\Dados de aplicativos\Microsoft Help

2007-10-07 23:52 --------- d-----w F:\Arquivos de programas\Microsoft Works

2007-10-07 23:50 --------- d-----w F:\Arquivos de programas\Microsoft.NET

2007-10-03 06:01 --------- d-----w F:\Documents and Settings\Mummy\Dados de aplicativos\SecondLife

2007-09-28 21:20 3,766 --sha-w F:\WINDOWS\system32\KGyGaAvL.sys

2007-09-28 14:23 --------- d-----w F:\Documents and Settings\Rafaela\Dados de aplicativos\HP

2007-09-28 14:07 --------- d-----w F:\Documents and Settings\mammy\Dados de aplicativos\Autodesk

2007-09-28 03:41 --------- d-----w F:\Documents and Settings\Pappy\Dados de aplicativos\Printer Info Cache

2007-09-28 03:41 --------- d-----w F:\Documents and Settings\Pappy\Dados de aplicativos\Image Zone Express

2007-09-28 03:29 --------- d-----w F:\Documents and Settings\Pappy\Dados de aplicativos\HP

2007-09-28 01:19 --------- d-----w F:\Documents and Settings\mammy\Dados de aplicativos\Leadertech

2007-09-28 01:19 --------- d-----w F:\Documents and Settings\mammy\Dados de aplicativos\AdobeUM

2007-09-28 01:19 --------- d-----w F:\Documents and Settings\mammy\Dados de aplicativos\AdobeAUM

2007-09-27 20:39 --------- d-----w F:\Documents and Settings\mammy\Dados de aplicativos\Corel

2007-09-27 20:37 --------- d-----w F:\Documents and Settings\mammy\Dados de aplicativos\HP

2007-09-27 20:13 --------- d-----w F:\Documents and Settings\LocalService\Dados de aplicativos\HP

2007-09-27 20:05 --------- d-----w F:\Documents and Settings\All Users\Dados de aplicativos\HPSSUPPLY

2007-09-27 20:05 --------- d-----w F:\Arquivos de programas\HP

2007-09-27 20:04 --------- d-----w F:\Arquivos de programas\Arquivos comuns\HP

2007-09-27 20:02 --------- d-----w F:\Documents and Settings\All Users\Dados de aplicativos\HP

2007-09-27 20:00 --------- d-----w F:\Arquivos de programas\Hewlett-Packard

2007-09-27 20:00 --------- d-----w F:\Arquivos de programas\Arquivos comuns\Hewlett-Packard

2007-09-27 19:56 --------- d-----w F:\Documents and Settings\All Users\Dados de aplicativos\Hewlett-Packard

2007-09-21 01:32 --------- d-----w F:\Arquivos de programas\Ares

2007-09-21 01:05 --------- d-----w F:\Arquivos de programas\Shareaza

2007-09-20 23:48 161,284 ----a-w F:\WINDOWS\Expstudio Audio Editor FREE Uninstaller.exe

2007-09-20 23:47 --------- d-----w F:\Arquivos de programas\Expstudio

2007-09-12 02:03 --------- d-----w F:\Arquivos de programas\Real Desktop

2007-05-26 00:07 24,192 ----a-w F:\Documents and Settings\Rafaela\usbsermptxp.sys

2007-05-26 00:07 22,768 ----a-w F:\Documents and Settings\Rafaela\usbsermpt.sys

2007-05-17 15:40 4,078,590 ----a-w F:\Arquivos de programas\OrkutCute_setup.zip

2007-04-16 02:01 33,319,168 ----a-w F:\Arquivos de programas\GoogleSketchUpWEN.exe

2007-04-16 00:19 18,029,424 ----a-w F:\Arquivos de programas\Install_Messenger.exe

2007-04-09 14:56 14,993,976 ----a-w F:\Arquivos de programas\GoogleEarthWin.exe

2007-03-16 15:22 17,352,721 ----a-w F:\Arquivos de programas\DecaCAD_v2.6.zip

2007-08-05 18:43:15 56 --sh--r F:\WINDOWS\system32\371BFC859B.sys

.

((((((((((((((((((((((((((((( snapshot@2007-11-12_15.36.26.64 )))))))))))))))))))))))))))))))))))))))))

.

+ 2007-11-12 19:36:16 16,384 ----atw F:\WINDOWS\Temp\Perflib_Perfdata_4cc.dat

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias & leg¡timas por defeito nÆo sÆo mostradas.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="F:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22]

"DAEMON Tools"="F:\Arquivos de programas\DAEMON Tools\daemon.exe" [2005-11-08 20:00]

"avast!"="F:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe" [2007-10-25 13:20]

"Sony Ericsson PC Suite"="H:\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 18:17]

"RemoteControl"="F:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe" [2005-12-07 22:57]

"QuickTime Task"="F:\Arquivos de programas\QuickTime\qttask.exe" [2006-10-25 18:58]

"nwiz"="nwiz.exe" [2006-10-22 12:22 F:\WINDOWS\system32\nwiz.exe]

"NvMediaCenter"="F:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 12:22]

"NeroFilterCheck"="F:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40]

"LanguageShortcut"="F:\Arquivos de programas\CyberLink\PowerDVD\Language\Language.exe" [2006-04-13 11:09]

"iTunesHelper"="F:\Arquivos de programas\iTunes\iTunesHelper.exe" [2006-10-30 09:36]

"ISUSScheduler"="F:\Arquivos de programas\Arquivos comuns\InstallShield\UpdateService\issch.exe" [2005-08-11 17:30]

"ISUSPM Startup"="f:\Arquivos de programas\Arquivos comuns\InstallShield\UpdateService\isuspm.exe" [2005-08-11 17:30]

"HP Software Update"="F:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 22:52]

"Adobe Photo Downloader"="F:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-07 00:46]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="F:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" []

"Picasa Media Detector"="F:\Arquivos de programas\Picasa2\PicasaMediaDetector.exe" []

"CoolSMS"="" []

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="F:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 19:04]

"ares"="F:\Arquivos de programas\Ares\Ares.exe" [2007-07-16 19:54]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoResolveSearch"=1 (0x1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{E37CB5F0-51F5-4395-A808-5FA49E399003}"= F:\Arquivos de programas\GbPlugin\gbiehcef.dll [2007-07-12 15:54 322120]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"RichVideo"=2 (0x2)

"ose"=3 (0x3)

"NBService"=3 (0x3)

"iPod Service"=3 (0x3)

"Autodesk Licensing Service"=3 (0x3)

"MDM"=2 (0x2)

"usnjsvc"=3 (0x3)

"mi-raysat_3dsmax8"=2 (0x2)

"NVSvc"=2 (0x2)

"AresChatServer"=3 (0x3)

"GbpSv"=2 (0x2)

"odserv"=3 (0x3)

R3 cwrwdm;SoundFusion WDM Driver;F:\WINDOWS\system32\DRIVERS\cwrwdm.sys

S2 GbpSv;Gbp Service;F:\Arquivos de programas\GbPlugin\GbpSv.exe

S3 lgusbsmodem;LGE Mobile USB Modem;F:\WINDOWS\system32\DRIVERS\lgusbsmodem.sys

S3 SE30bus;Sony Ericsson Device 048 Driver driver (WDM);F:\WINDOWS\system32\DRIVERS\SE30bus.sys

S3 SE30mdfl;Sony Ericsson Device 048 USB WMC Modem Filter;F:\WINDOWS\system32\DRIVERS\SE30mdfl.sys

S3 SE30mdm;Sony Ericsson Device 048 USB WMC Modem Driver;F:\WINDOWS\system32\DRIVERS\SE30mdm.sys

S3 SE30mgmt;Sony Ericsson Device 048 USB WMC Device Management Drivers (WDM);F:\WINDOWS\system32\DRIVERS\SE30mgmt.sys

S3 se30nd5;Sony Ericsson Device 048 USB Ethernet Emulation SEMC48 (NDIS);F:\WINDOWS\system32\DRIVERS\se30nd5.sys

S3 SE30obex;Sony Ericsson Device 048 USB WMC OBEX Interface;F:\WINDOWS\system32\DRIVERS\SE30obex.sys

S3 se30unic;Sony Ericsson Device 048 USB Ethernet Emulation SEMC48 (WDM);F:\WINDOWS\system32\DRIVERS\se30unic.sys

S3 w300bus;Sony Ericsson W300 Driver driver (WDM);F:\WINDOWS\system32\DRIVERS\w300bus.sys

S3 w300mdfl;Sony Ericsson W300 USB WMC Modem Filter;F:\WINDOWS\system32\DRIVERS\w300mdfl.sys

S3 w300mdm;Sony Ericsson W300 USB WMC Modem Driver;F:\WINDOWS\system32\DRIVERS\w300mdm.sys

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt hpqcxs08 hpqddsvc

.

Conte£do da pasta 'Tarefas Agendadas'

"2007-11-12 18:30:00 F:\WINDOWS\Tasks\Advanced WindowsCare V2 Pro.job"

- F:\Arquivos de programas\IObit\Advanced WindowsCare V2 Pro\AutoCare.exe

"2007-09-22 23:36:09 F:\WINDOWS\Tasks\AppleSoftwareUpdate.job"

- F:\Arquivos de programas\Apple Software Update\SoftwareUpdate.exe

"2007-11-06 22:00:00 F:\WINDOWS\Tasks\AwcProUpdate.job"

- F:\Arquivos de programas\IObit\Advanced WindowsCare V2 Pro\AutoUpdate.exe

.

**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-11-12 17:36:58

Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializ veis ocultas ...

Procurando ficheiros ocultos ...

Varredura completada com sucesso

Ficheiros ocultos: 0

**************************************************************************

.

Tempo para conclusÆo: 2007-11-12 17:39:15 - machine was rebooted

F:\ComboFix2.txt ... 2007-11-12 15:37

.

--- E O F ---

E o novo log do HijackThis

Logfile of HijackThis v1.99.1

Scan saved at 17:41:23, on 12/11/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

F:\WINDOWS\System32\smss.exe

F:\WINDOWS\system32\csrss.exe

F:\WINDOWS\system32\winlogon.exe

F:\WINDOWS\system32\services.exe

F:\WINDOWS\system32\lsass.exe

F:\WINDOWS\system32\svchost.exe

F:\WINDOWS\System32\svchost.exe

F:\WINDOWS\system32\svchost.exe

F:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

F:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

F:\WINDOWS\Explorer.EXE

F:\WINDOWS\system32\spoolsv.exe

F:\WINDOWS\system32\svchost.exe

F:\WINDOWS\System32\svchost.exe

F:\WINDOWS\system32\svchost.exe

F:\WINDOWS\system32\wdfmgr.exe

F:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

F:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

F:\Arquivos de programas\DAEMON Tools\daemon.exe

F:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

H:\Mobile2\Application Launcher\Application Launcher.exe

F:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe

F:\Arquivos de programas\QuickTime\qttask.exe

F:\WINDOWS\System32\alg.exe

F:\Arquivos de programas\Arquivos comuns\InstallShield\UpdateService\issch.exe

F:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

F:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

F:\Arquivos de programas\Arquivos comuns\Teleca Shared\CapabilityManager.exe

F:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe

F:\Arquivos de programas\Ares\Ares.exe

F:\WINDOWS\system32\wuauclt.exe

F:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe

F:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexStoreSvr.exe

F:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

F:\Arquivos de programas\HP\Digital Imaging\bin\hpqSTE08.exe

f:\arquivos de programas\arquivos comuns\installshield\updateservice\isuspm.exe

F:\Arquivos de programas\Arquivos comuns\Teleca Shared\Generic.exe

H:\Mobile2\Mobile Phone Monitor\epmworker.exe