[Arquivado] estou infectado com trojans

lictor · Maio 1, 2008

Boa noite depois de fazer um scan com o meu antivirus (AVG free edition) ele depaou se com um virus. Entao corri o kaspersky online e ele dectetou uma porrada de trojans espero que me consigam ajudar junto envio relatorios do hijackthis e do kaspersky

LOG DO HIJACKTHIS

Logfile of HijackThis v1.99.1

Scan saved at 23:42:09, on 01-05-2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\Programas\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\Programas\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programas\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

C:\Programas\CDBurnerXP\NMSAccessU.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\PnkBstrB.exe

C:\Programas\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Programas\Windows Defender\MSASCui.exe

C:\Programas\Java\jre1.6.0_05\bin\jusched.exe

C:\Programas\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Programas\Spybot - Search & Destroy\TeaTimer.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe

C:\Programas\Windows Live\Messenger\usnsvc.exe

C:\Programas\Internet Explorer\iexplore.exe

C:\Programas\Ficheiros comuns\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\PROGRA~1\FREEDO~1\fdm.exe

C:\Programas\Internet Explorer\iexplore.exe

C:\Documents and Settings\Duarte Assuncao\Ambiente de trabalho\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netmadeira.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hiperligações

O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Ficheiros comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Windows Live OneCare Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Programas\Windows Live\Proteção para a Família\fssbho.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programas\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programas\Ficheiros comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Programas\Free Download Manager\iefdm2.dll

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe

O4 - HKLM\..\Run: [Windows Defender] "C:\Programas\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Programas\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Programas\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Programas\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHEI~1\MICROS~1\DW\dwtrig20.exe" -t

O4 - HKCU\..\Run: [uTorrent] "C:\Programas\utorrent\utorrent.exe"

O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: Baixar com o FDM - file://C:\Programas\Free Download Manager\dllink.htm

O8 - Extra context menu item: Baixar tudo com o FDM - file://C:\Programas\Free Download Manager\dlall.htm

O8 - Extra context menu item: Download selecionado pelo FDM - file://C:\Programas\Free Download Manager\dlselected.htm

O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Programas\Free Download Manager\dlfvideo.htm

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programas\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programas\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab

O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab

O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.pt/s/v/27.38/uploader2.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shock...ash/swflash.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programas\Windows Live\Mail\mailcomm.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Programas\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programas\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programas\Ficheiros comuns\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: NMSAccessU - Unknown owner - C:\Programas\CDBurnerXP\NMSAccessU.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

O23 - Service: ServiceLayer - Nokia. - C:\Programas\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programas\Analog Devices\SoundMAX\SMAgent.exe

LOG DO KASPERSKY

-------------------------------------------------------------------------------

KASPERSKY ONLINE SCANNER REPORT

Thursday, May 01, 2008 11:31:35 PM

Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)

Kaspersky Online Scanner version: 5.0.98.0

Kaspersky Anti-Virus database last update: 1/05/2008

Kaspersky Anti-Virus database records: 734552

-------------------------------------------------------------------------------

Scan Settings:

Scan using the following antivirus database: extended

Scan Archives: true

Scan Mail Bases: true

Scan Target - My Computer:

A:\

C:\

D:\

E:\

F:\

G:\

Scan Statistics:

Total number of scanned objects: 83791

Number of viruses found: 2

Number of infected objects: 1

Number of suspicious objects: 11

Duration of the scan process: 02:40:18

Infected Object Name / Virus Name / Last Action

C:\ca2008065327b32f60cd83\$shtdwn$.req Object is locked skipped

C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-10182007-135954.log Object is locked skipped

C:\Documents and Settings\Duarte Assuncao\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\Duarte Assuncao\Definições locais\Application Data\IM\Identities\{7732B755-6617-4C38-87C0-6ADA994A7B55}\Message Store\Caixa_de_entrada_[1].imm/[From "eBay"<message@eBay.com>][Date Sat, 15 Sep 2007 17:46:39 -0400]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped

C:\Documents and Settings\Duarte Assuncao\Definições locais\Application Data\IM\Identities\{7732B755-6617-4C38-87C0-6ADA994A7B55}\Message Store\Caixa_de_entrada_[1].imm Mail: suspicious - 1 skipped

C:\Documents and Settings\Duarte Assuncao\Definições locais\Application Data\IM\Identities\{7732B755-6617-4C38-87C0-6ADA994A7B55}\Message Store\Deleted Items.imm/[From IncrediMail][Date Tue, 8 Jun 2004 12:00:04 +0000]/UNNAMED/[From IncrediMail][Date Tue, 8 Jun 2004 12:00:03 +0000]/UNNAMED/[From IncrediMail][Date Tue, 8 Jun 2004 12:00:02 +0000]/UNNAMED/[From IncrediMail][Date Thu, 8 Jun 2004 12:00:01 +0000]/UNNAMED/[From gary rd <garyigor@hotmail.co.uk>][Date Sun, 23 Sep 2007 22:37:50 +0100]/UNNAMED/[From "eBay"<message@eBay.com>][Date Sat, 15 Sep 2007 17:46:39 -0400]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped

C:\Documents and Settings\Duarte Assuncao\Definições locais\Application Data\IM\Identities\{7732B755-6617-4C38-87C0-6ADA994A7B55}\Message Store\Deleted Items.imm/[From IncrediMail][Date Tue, 8 Jun 2004 12:00:04 +0000]/UNNAMED/[From IncrediMail][Date Tue, 8 Jun 2004 12:00:03 +0000]/UNNAMED/[From IncrediMail][Date Tue, 8 Jun 2004 12:00:02 +0000]/UNNAMED/[From IncrediMail][Date Thu, 8 Jun 2004 12:00:01 +0000]/UNNAMED/[From gary rd <garyigor@hotmail.co.uk>][Date Sun, 23 Sep 2007 22:37:50 +0100]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped

C:\Documents and Settings\Duarte Assuncao\Definições locais\Application Data\IM\Identities\{7732B755-6617-4C38-87C0-6ADA994A7B55}\Message Store\Deleted Items.imm/[From IncrediMail][Date Tue, 8 Jun 2004 12:00:04 +0000]/UNNAMED/[From IncrediMail][Date Tue, 8 Jun 2004 12:00:03 +0000]/UNNAMED/[From IncrediMail][Date Tue, 8 Jun 2004 12:00:02 +0000]/UNNAMED/[From IncrediMail][Date Thu, 8 Jun 2004 12:00:01 +0000]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped

C:\Documents and Settings\Duarte Assuncao\Definições locais\Application Data\IM\Identities\{7732B755-6617-4C38-87C0-6ADA994A7B55}\Message Store\Deleted Items.imm/[From IncrediMail][Date Tue, 8 Jun 2004 12:00:04 +0000]/UNNAMED/[From IncrediMail][Date Tue, 8 Jun 2004 12:00:03 +0000]/UNNAMED/[From IncrediMail][Date Tue, 8 Jun 2004 12:00:02 +0000]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped

C:\Documents and Settings\Duarte Assuncao\Definições locais\Application Data\IM\Identities\{7732B755-6617-4C38-87C0-6ADA994A7B55}\Message Store\Deleted Items.imm/[From IncrediMail][Date Tue, 8 Jun 2004 12:00:04 +0000]/UNNAMED/[From IncrediMail][Date Tue, 8 Jun 2004 12:00:03 +0000]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped

C:\Documents and Settings\Duarte Assuncao\Definições locais\Application Data\IM\Identities\{7732B755-6617-4C38-87C0-6ADA994A7B55}\Message Store\Deleted Items.imm/[From IncrediMail][Date Tue, 8 Jun 2004 12:00:04 +0000]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped

C:\Documents and Settings\Duarte Assuncao\Definições locais\Application Data\IM\Identities\{7732B755-6617-4C38-87C0-6ADA994A7B55}\Message Store\Deleted Items.imm Mail: suspicious - 6 skipped

C:\Documents and Settings\Duarte Assuncao\Definições locais\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped

C:\Documents and Settings\Duarte Assuncao\Definições locais\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\Duarte Assuncao\Definições locais\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\Duarte Assuncao\Definições locais\Application Data\Microsoft\Windows Defender\FileTracker\{9F9826F4-7B47-4C22-B999-ED351A2B9047} Object is locked skipped

C:\Documents and Settings\Duarte Assuncao\Definições locais\Histórico\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Duarte Assuncao\Definições locais\Histórico\History.IE5\MSHist012008050120080502\index.dat Object is locked skipped

C:\Documents and Settings\Duarte Assuncao\Definições locais\Temp\Free Download Manager\tic37.tmp Object is locked skipped

C:\Documents and Settings\Duarte Assuncao\Definições locais\Temp\Perflib_Perfdata_2a8.dat Object is locked skipped

C:\Documents and Settings\Duarte Assuncao\Definições locais\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Duarte Assuncao\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\Duarte Assuncao\NTUSER.DAT.LOG Object is locked skipped

C:\Documents and Settings\Duarte Assuncao\UserData\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Definições locais\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Definições locais\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Definições locais\Histórico\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Definições locais\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Definições locais\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Definições locais\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Downloads\[PC GAME] UEFA.EURO.2008-ViTALiTY.part2.rar Object is locked skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{250C2AB1-0DD2-4D25-BCF0-EE13E58093FD}\RP312\A0030666.dll Infected: not-a-virus:AdTool.Win32.WhenU.r skipped

C:\System Volume Information\_restore{250C2AB1-0DD2-4D25-BCF0-EE13E58093FD}\RP357\change.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\EventCache\{5C6DA7CF-DE67-47EA-A1B1-31175AD6C1AE}.bin Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\Internet.evt Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

D:\IM\Identities\{025A5AA7-C900-43ED-8154-1E0E5A0E3CAC}\Message Store\Inbox.imm/[From "eBay"<message@eBay.com>][Date Sat, 15 Sep 2007 17:46:39 -0400]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped

D:\IM\Identities\{025A5AA7-C900-43ED-8154-1E0E5A0E3CAC}\Message Store\Inbox.imm Mail: suspicious - 1 skipped

D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

D:\System Volume Information\_restore{250C2AB1-0DD2-4D25-BCF0-EE13E58093FD}\RP357\change.log Object is locked skipped

Scan process completed.

DigRam · Maio 2, 2008

Bom Dia! lictor

Abra o Spybot.
No menu superior, vá em Modo e selecione a opção Avançado.Confirme!

Clique no botão Ferramentas e depois em Residente.

Desmarque a opção: Ativar "TeaTimer" do Residente. ( Proteção geral das configurações de sistema )

Saia do Programa e reinicie o computador!

-------------------------------------

>@< Faça um escaneamento de desinfecção em < BitDefender > e poste o relatório.

>@< Abrirá a página: < BitDefender OnLine Scanner >

>@< Clique em: < >

>@< Aguarde!Permita a instalação do ActiveX,para que possa ocorrer o scan.

<!> Leia o Tutorial: < Link >

>@< Poste,então: Relatório do BitDefender + Log do HijackThis,atualizado.

>@< Ps: O relatório do BitDefender,estará em: C:\Windows\BDOSCAN8\bdoscan.log

Abraços!

lictor · Maio 3, 2008

Ola Boa noite DigRem! Antes de mais quero agradecer a sua disponibilidade para me ajudar. aqui esta o meu relatorio do bitdefender

[General]

App = "BitDefender Online Scanner v8"

Date = 02:05:2008

Time = 23:53:54

Scan Path = A:\;C:\;D:\;E:\;F:\;G:\;

[Engines Info]

Virus Definitions = 1189114

Engine build = "AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)"

Scan plugins = 16

Archive plugins = 42

Unpack plugins = 7

E-mail plugins = 6

System plugins = 5

[scan Statistics]

Folders = 6874

Files = 205015

Archives = 2951

Packed files = 11093

Identified viruses = 2

Infected files = 2

Warnings = 0

Suspect files = 0

Disinfected files = 0

Deleted files = 2

Copied files = 0

Moved files = 0

Renamed files = 0

I/O Errors = 31

[scan Settings]

SecondAction = Delete

FirstAction = Disinfect

Heuristics = 1

Enable Warnings = 1

Exclude Ext =

Extensions = *;

Scan Emails = 1

Scan Archives = 1

Scan Packed = 1

Scan Files = 1

Scan Boot = 1

Verify Memory = 0

[scan Results]

Line00000006 = "C:\System Volume Information\_restore{250C2AB1-0DD2-4D25-BCF0-EE13E58093FD}\RP312\A0030666.dll Detected with: Application.Memedia.B"

Line00000005 = "C:\System Volume Information\_restore{250C2AB1-0DD2-4D25-BCF0-EE13E58093FD}\RP312\A0030666.dll Disinfection failed"

Line00000004 = "C:\System Volume Information\_restore{250C2AB1-0DD2-4D25-BCF0-EE13E58093FD}\RP312\A0030666.dll Deleted"

Line00000003 = "C:\System Volume Information\_restore{250C2AB1-0DD2-4D25-BCF0-EE13E58093FD}\RP350\A0039684.exe=>(CAB Sfx r)=>crack.exe Infected with: Backdoor.PoisonIvy.CV"

Line00000002 = "C:\System Volume Information\_restore{250C2AB1-0DD2-4D25-BCF0-EE13E58093FD}\RP350\A0039684.exe=>(CAB Sfx r)=>crack.exe Disinfection failed"

Line00000001 = "C:\System Volume Information\_restore{250C2AB1-0DD2-4D25-BCF0-EE13E58093FD}\RP350\A0039684.exe=>(CAB Sfx r)=>crack.exe Deleted"

Line00000000 = "C:\System Volume Information\_restore{250C2AB1-0DD2-4D25-BCF0-EE13E58093FD}\RP350\A0039684.exe=>(CAB Sfx r) Update failed"

E aqui o log do hijackthis

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 2:37:39, on 03-05-2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\Programas\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\Programas\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programas\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

C:\Programas\CDBurnerXP\NMSAccessU.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\PnkBstrB.exe

C:\Programas\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

C:\Programas\Windows Defender\MSASCui.exe

C:\Programas\Java\jre1.6.0_05\bin\jusched.exe

C:\Programas\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programas\utorrent\utorrent.exe

C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe

C:\Programas\Internet Explorer\iexplore.exe

C:\Programas\Ficheiros comuns\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Documents and Settings\Duarte Assuncao\Ambiente de trabalho\HiJackThis.exe