[Arquivado] a_Não consigo mais entrar no Orkut usando o I.E.

MarKteus · Dezembro 1, 2007

Boa tarde !!

Toda vez q tento entrar no Orkut utilizando o Internet Explorer, depois de digitado a senha e login aparece na barra de endereços algo como redirecionando:

https://www.google.com/accounts/CheckCookie?continue=http%3A%2F%2Fwww.orkut.com%2

FRedirLogin.aspx%3Fmsg%3D0%26page%3Dhttp%253A%252F%252Fwww.orkut.com%252F&service=orkut&hl=pt-BR&chtml=LoginDoneHtml

E ñ sai mais disso, o q pode estar acontecendo ?

jgarcia · Dezembro 2, 2007

Opa MarKteus,

Faça o seguinte:

Baixe o HijackThis versão 1.99.1.

Depois > Iniciar > Meu Computador > 02 cliques no C > Coloca o HijackThis no C (extraindo do zip --> para uma pasta própria tipo c:/Hijack).

Execute o Hijack a partir do C, fechando os demais programas (deixando somente a área de trabalho).

Clique em Do a system scan and save a logfile, mas não marque nada, apenas poste o log gerado aqui neste mesmo tópico.

Abraços.

MarKteus · Dezembro 3, 2007

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:23:04, on 3/12/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\VTTimer.exe

C:\Arquivos de programas\Network Associates\Common Framework\UpdaterUI.exe

C:\Arquivos de programas\Java\jre1.6.0_03\bin\jusched.exe

C:\Arquivos de programas\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe

C:\Arquivos de programas\DAEMON Tools\daemon.exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

C:\Arquivos de programas\Skype\Phone\Skype.exe

C:\Arquivos de programas\honestech\honestech TVR 2.5\scheduleTV.exe

C:\Arquivos de programas\PlayTV MPEG 2\PVRemote.exe

C:\Arquivos de programas\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Arquivos de programas\Bonjour\mDNSResponder.exe

C:\Arquivos de programas\Network Associates\Common Framework\FrameworkService.exe

C:\Arquivos de programas\Network Associates\VirusScan\VsTskMgr.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wscntfy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.binariosinformatica.com.br/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O4 - HKLM\..\Run: [VTTimer] VTTimer.exe

O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe

O4 - HKLM\..\Run: [shStatEXE] "C:\Arquivos de programas\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE

O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Arquivos de programas\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Arquivos de programas\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [OSSelectorReinstall] C:\Arquivos de programas\Arquivos comuns\Acronis\Acronis Disk Director\oss_reinstall.exe

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [RaidTool] C:\Arquivos de programas\VIA\RAID\raid_t

O4 - HKLM\..\Run: [statusClient] C:\Arquivos de programas\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto

O4 - HKLM\..\Run: [soundMAXPnP] C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe

O4 - HKLM\..\Run: [soundMAX] "C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe" /tray

O4 - HKLM\..\Run: [DAEMON Tools] "C:\Arquivos de programas\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [NBJ] "C:\Arquivos de programas\Ahead\Nero BackItUp\NBJ.exe"

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Arquivos de programas\Arquivos comuns\Ahead\lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [TelExtreme] C:\Arquivos de programas\TelExtreme\TelExtreme

O4 - HKCU\..\Run: [skype] "C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Adobe Gamma.lnk = C:\Arquivos de programas\Arquivos comuns\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Startup: PVRemote.lnk = C:\Arquivos de programas\PlayTV MPEG 2\PVRemote.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office\OSA9.EXE

O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Arquivos de programas\Arquivos comuns\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Arquivos de programas\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: TVR Scheduler.lnk = C:\Arquivos de programas\honestech\honestech TVR 2.5\scheduleTV.exe

O8 - Extra context menu item: Save Flash by &GetFlash - C:\ARQUIV~1\GETFLASH\getflash.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} -

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -

O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} -

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} -

O17 - HKLM\System\CCS\Services\Tcpip\..\{F5100C48-14EF-4AD6-8AE3-28932553FD58}: NameServer = 200.225.197.34,200.225.197.37

O20 - AppInit_DLLs:

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Arquivos de programas\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Arquivos de programas\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Arquivos de programas\Network Associates\Common Framework\FrameworkService.exe

O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Arquivos de programas\Network Associates\VirusScan\Mcshield.exe

O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Arquivos de programas\Network Associates\VirusScan\VsTskMgr.exe

O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - C:\Arquivos de programas\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe (file missing)

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

--

End of file - 7748 bytes

jgarcia · Dezembro 4, 2007

Opa MarKteus,

Baixe o ComboFix em:

ComboFix

1) Desabilite o seu anti-vírus temporariamente;

2) Dê um duplo-clique no combofix.exe e tecle "1" para prosseguir. O processo vai durar, em média, 10 minutos;

3) O ComboFix reiniciará o PC automaticamente, a fim de que o processo de remoção seja finalizado (somente se houver infecção);

4) Quando a varredura acabar, será gerado um log, que estará em C:\ComboFix.txt;

5) Não clique na janela do ComboFix, nem feche clicando no X, enquanto a ferramenta estiver sendo executada, pois isto implicará na desconfiguração de seu desktop (ele ficará todo branco);

6) Para parar ou sair do ComboFix, tecle "N";

7) Reabilite o seu anti-vírus;

8) Preciso que você cole o conteúdo do ComboFix.txt em sua próxima resposta, juntamente com um novo log do HijackThis.

Abraços.

MarKteus · Dezembro 5, 2007

ComboFix 07-12-02.7 - Marcos 2007-12-05 17:12:07.1 - FAT32x86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.691 [GMT -2:00]

Executando de: C:\Documents and Settings\Marcos\Desktop\ComboFix.exe

* Criado um novo ponto de restauro

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\1.exe

C:\WINDOWS\system32\Cache

C:\WINDOWS\system32\Cfx32.lic

C:\WINDOWS\system32\cfx32.ocx

C:\WINDOWS\system32\regscan.exe

.

((((((((((((((((((((((( Ficheiros criados de 2007-11-05 to 2007-12-05 ))))))))))))))))))))))))))))))))

.

2007-12-05 16:52 . 2007-12-05 16:52 798,652 --a------ C:\Viewer.psd

2007-12-05 11:49 . 2007-12-05 11:49 54,156 --ah----- C:\WINDOWS\QTFont.qfn

2007-12-05 11:49 . 2007-12-05 11:49 1,409 --a------ C:\WINDOWS\QTFont.for

2007-12-01 15:50 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl

2007-12-01 12:42 . 2007-12-01 12:50 19 --a------ C:\WINDOWS\msxfcg32.dll

2007-11-29 15:39 . 2007-11-29 15:39 <DIR> d-------- C:\Documents and Settings\Marcos\Dados de aplicativos\uTorrent

2007-11-29 15:39 . 2007-11-29 15:40 <DIR> d-------- C:\Arquivos de programas\uTorrent

2007-11-26 18:43 . 2007-11-26 18:43 <DIR> d-------- C:\DVD´s

2007-11-26 18:36 . 2007-11-26 18:36 <DIR> d-------- C:\Arquivos de programas\DVD Shrink

2007-11-22 16:30 . 2007-11-22 16:30 <DIR> d-------- C:\WINDOWS\Sun

2007-11-21 17:15 . 2007-11-21 17:15 <DIR> d-------- C:\FigsAulas

2007-11-21 15:59 . 2007-11-21 15:59 <DIR> d-------- C:\Arquivos de programas\QuickTime

2007-11-21 15:58 . 2007-11-21 15:58 <DIR> d-------- C:\Arquivos de programas\Bonjour

2007-11-21 15:53 . 2007-11-21 15:53 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Macrovision Shared

2007-11-19 16:55 . 2004-08-04 04:45 221,184 --a------ C:\WINDOWS\system32\wmpns.dll

2007-11-17 18:15 . 2007-11-17 18:15 34,816 --a------ C:\Stamos em pleno mar.doc

2007-11-14 12:12 . 2007-11-14 12:13 441,864 --a------ C:\Documents and Settings\Marcos\tmpms45.exe

2007-11-14 12:12 . 2007-11-14 12:12 393,224 --a------ C:\syswums.exe

2007-11-13 12:18 . 2007-11-13 12:18 <DIR> d-------- C:\Arquivos de programas\Magic ASCII Studio

2007-11-13 12:18 . 2007-11-13 12:18 12 --a------ C:\WINDOWS\MTWDAS.INI

2007-11-13 12:18 . 2007-11-13 12:18 4 --a------ C:\WINDOWS\system32\XMCACTSLCI

2007-11-13 12:18 . 2007-11-13 12:18 4 --a------ C:\WINDOWS\SAXGATXNMY

2007-11-13 10:05 . 2007-11-13 10:05 <DIR> d-------- C:\Arquivos de programas\CCleaner

2007-11-12 08:45 . 2007-12-01 16:17 1,440 --a------ C:\WINDOWS\mozver.dat

2007-11-05 07:20 . 2007-11-05 08:01 27,648 --a------ C:\Avaliação de Segunda Chamada 8.doc

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2007-10-30 17:38 --------- d-----w C:\Arquivos de programas\Create-Ringtone

2007-10-29 17:38 --------- d-----w C:\Arquivos de programas\AnMing

2007-10-15 11:28 --------- d-----w C:\Arquivos de programas\K-Lite Codec Pack

2007-10-11 20:24 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Trymedia

2004-10-01 17:00 40,960 ----a-w C:\Arquivos de programas\Uninstall_CDS.exe

.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

----a-w 155,648 2001-07-09 12:50:42 C:\WINDOWS\system32\bak\NeroCheck.exe

----a-w 155,648 2001-07-09 12:50:42 C:\WINDOWS\system32\NeroCheck.exe

----a-w 159,744 2004-08-04 06:45:40 C:\WINDOWS\pchealth\helpctr\binaries\bak\MSConfig.exe

----a-w 159,744 2004-08-04 06:45:40 C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe

----a-w 147,514 2003-10-07 11:48:56 C:\Arquivos de programas\Arquivos comuns\Network Associates\TalkBack\bak\TBMon.exe

----a-w 147,514 2003-10-07 11:48:56 C:\Arquivos de programas\Arquivos comuns\Network Associates\TalkBack\TBMon.exe

----a-w 94,208 2005-10-28 18:25:44 C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\bak\NMBgMonitor.exe

----a-w 32,768 2004-11-02 22:24:46 C:\Arquivos de programas\CyberLink DVD Solution\PowerDVD\bak\PDVDServ.exe

----a-w 155,648 2003-03-31 21:28:28 C:\Arquivos de programas\Hewlett-Packard\Toolbox2.0\bak\hpbpsttp.exe

----a-w 36,864 2002-12-16 18:51:24 C:\Arquivos de programas\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\bak\StatusClient.exe

----a-w 98,304 2006-06-06 06:43:14 C:\Arquivos de programas\Hewlett-Packard\OrderReminder\OrderReminder\bak\OrderReminder.exe

----a-w 90,112 2003-03-29 10:53:44 C:\Arquivos de programas\VirtualDrive\bak\VDTask.exe

----a-w 155,648 2006-09-07 18:38:10 C:\Arquivos de programas\QuickTime Alternative\bak\qttask.exe

----a-w 1,415,824 2005-05-31 03:04:00 C:\Arquivos de programas\Spybot - Search & Destroy\bak\TeaTimer.exe

----a-w 1,415,824 2005-05-31 03:04:00 C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

REGEDIT4

*Nota* entradas vazias & legítimas por defeito não são mostradas.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSMSGS"="C:\Arquivos de programas\Messenger\msmsgs.exe" [2004-08-04 00:56]

"PowerBar"="" []

"SpybotSD TeaTimer"="C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 01:04]

"NBJ"="C:\Arquivos de programas\Ahead\Nero BackItUp\NBJ.exe" [2005-10-11 18:25]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Arquivos de programas\Arquivos comuns\Ahead\lib\NMBgMonitor.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"VTTimer"="VTTimer.exe" [2005-03-09 08:33 C:\WINDOWS\system32\VTTimer.exe]

"VTTrayp"="VTtrayp.exe" [2005-03-12 22:33 C:\WINDOWS\system32\VTTrayp.exe]

"ShStatEXE"="C:\Arquivos de programas\Network Associates\VirusScan\SHSTAT.exe" [2004-09-30 08:00]

"McAfeeUpdaterUI"="C:\Arquivos de programas\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 03:50]

"SunJavaUpdateSched"="C:\Arquivos de programas\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]

"!AVG Anti-Spyware"="C:\Arquivos de programas\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 06:25]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]

"OSSelectorReinstall"="C:\Arquivos de programas\Arquivos comuns\Acronis\Acronis Disk Director\oss_reinstall.exe" [2006-04-12 15:15]

"RaidTool"="C:\Arquivos de programas\VIA\RAID\raid_t" []

"StatusClient"="C:\Arquivos de programas\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe" []

"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 04:45]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 07:45]

C:\Documents and Settings\Marcos\Menu Iniciar\Programas\Inicializar\

Adobe Gamma.lnk - C:\Arquivos de programas\Arquivos comuns\Adobe\Calibration\Adobe Gamma Loader.exe [2006-06-06 14:57:34]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Adobe Gamma Loader.exe.lnk]

path=C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\Adobe Gamma Loader.exe.lnk

backup=C:\WINDOWS\pss\Adobe Gamma Loader.exe.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Adobe Reader Speed Launch.lnk]

path=C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\Adobe Reader Speed Launch.lnk

backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Microsoft Office.lnk]

path=C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\Microsoft Office.lnk

backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^TVR Scheduler.lnk]

path=C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\TVR Scheduler.lnk

backup=C:\WINDOWS\pss\TVR Scheduler.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Marcos^Menu Iniciar^Programas^Inicializar^PVRemote.lnk]

path=C:\Documents and Settings\Marcos\Menu Iniciar\Programas\Inicializar\PVRemote.lnk

backup=C:\WINDOWS\pss\PVRemote.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]

C:\Arquivos de programas\DAEMON Tools\daemon.exe -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]

C:\Arquivos de programas\Skype\Phone\Skype.exe /nosplash /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]

C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe /tray

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]

2004-04-01 10:52 1368064 --a------ C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TelExtreme]

C:\Arquivos de programas\TelExtreme\TelExtreme

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"ewido anti-spyware 4.0 guard"=2 (0x2)

"Autodesk Licensing Service"=2 (0x2)

"Adobe LM Service"=3 (0x3)

"wuauserv"=2 (0x2)

"SysmonLog"=3 (0x3)

"SoundMAX Agent Service (default)"=2 (0x2)

"SENS"=2 (0x2)

"mi-raysat_3dsmax9_32"=2 (0x2)

R0 snapman;Acronis Snapshots Manager;C:\WINDOWS\system32\DRIVERS\snapman.sys

R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys

R1 cdawdm;CDAWDM;C:\WINDOWS\system32\DRIVERS\CDAWDM.sys

R1 NaiAvTdi1;NaiAvTdi1;C:\WINDOWS\system32\drivers\mvstdi5x.sys

S3 CXTuner;Conexant TVTuner;C:\WINDOWS\system32\drivers\CXTuner.sys

S3 CXVideo;Conexant Capture;C:\WINDOWS\system32\drivers\CXVCap.sys

S3 CXXBar;Conexant Crossbar;C:\WINDOWS\system32\drivers\CXXBar.sys

*Newly Created Service* - CATCHME

*Newly Created Service* - PROCEXP90

.

**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-12-05 17:14:08

Windows 5.1.2600 Service Pack 2 FAT NTAPI

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

PowerBar = ????<???D??sh??????w????h???2??w(??????wt?@?l?@???l???????????????????????????3????????????????????w???????w???w???????w???w????D??s*??????????w????l?@?????.??w????t?@? (o?????????l?@?l?@????????w????t?@?????l?@?8?@?l?@?3??s????????????????????8?@?_??s8?@?8?@

Procurando ficheiros ocultos ...

Varredura completada com sucesso

Ficheiros ocultos: 0

**************************************************************************

.

Tempo para conclusão: 2007-12-05 17:16:01

.

--- E O F ---

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:27:00, on 5/12/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Arquivos de programas\Bonjour\mDNSResponder.exe

C:\Arquivos de programas\Network Associates\Common Framework\FrameworkService.exe

C:\Arquivos de programas\Network Associates\VirusScan\VsTskMgr.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\VTTimer.exe

C:\Arquivos de programas\Network Associates\Common Framework\UpdaterUI.exe

C:\Arquivos de programas\Java\jre1.6.0_03\bin\jusched.exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\Arquivos de programas\MSN Messenger\msnmsgr.exe

C:\WINDOWS\explorer.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe