[Arquivado] virus CID-ele abre varios popups chatos

inuyasharyu · Junho 25, 2008

eu to convivendo com este CID faz tempo

estou querendo ajuda para elimina-lo

muiito obrigado aew

esta aew meu log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:26:20, on 25/6/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0013)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Arquivos de programas\Bonjour\mDNSResponder.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

C:\Arquivos de programas\D-Tools\daemon.exe

C:\WINDOWS\System32\svchost.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\Arquivos de programas\Java\jre1.6.0_05\bin\jusched.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

C:\Arquivos de programas\iTunes\iTunesHelper.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexStoreSvr.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE

C:\Arquivos de programas\iPod\bin\iPodService.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqSTE08.exe

C:\WINDOWS\system32\wuauclt.exe

C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uol.com.br/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy3.redegov.sp.gov.br:80

R3 - URLSearchHook: Barra de Ferramentas do Yahoo! com bloqueador de pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\ARQUIV~1\MEGAUP~1\MEGAUP~1.DLL

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar1.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Arquivos de programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Arquivos de programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Barra de Ferramentas do Yahoo! com bloqueador de pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar1.dll

O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\ARQUIV~1\MEGAUP~1\MEGAUP~1.DLL

O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Arquivos de programas\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Arquivos de programas\D-Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [HP Software Update] C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Arquivos de programas\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Date Army Wma Spam] C:\Documents and Settings\All Users\Dados de aplicativos\Peak ooze date army\Bows Aim.exe

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Wipe Htm] C:\DOCUME~1\marcos\DADOSD~1\STOPSE~1\gplfaceinternet.exe

O4 - HKCU\..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Adobe Gamma.lnk = C:\Arquivos de programas\Arquivos comuns\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Arquivos de programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Arquivos de programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Arquivos de programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Arquivos de programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Arquivos de programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Arquivos de programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Arquivos de programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert to existing PDF - res://C:\Arquivos de programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1208873794843

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O20 - AppInit_DLLs: C:\ARQUIV~1\KASPER~1\KASPER~1.0\kloehk.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Arquivos de programas\Arquivos comuns\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Arquivos de programas\Ares\chatServer.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Arquivos de programas\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Serviço iPod (iPod Service) - Apple Inc. - C:\Arquivos de programas\iPod\bin\iPodService.exe

O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/marcos/CONFIG~1/Temp/msohtml1/04/clip_image001.jpg

--

End of file - 12460 bytes

jgarcia · Junho 27, 2008

Opa inuyasharyu,

Baixe o ComboFix em:

ComboFix

1) Desabilite o seu anti-vírus temporariamente;

2) Dê um duplo-clique no combofix.exe e tecle "1" para prosseguir. O processo vai durar, em média, 10 minutos;

3) O ComboFix reiniciará o PC automaticamente, a fim de que o processo de remoção seja finalizado (somente se houver infecção);

4) Quando a varredura acabar, será gerado um log, que estará em C:\ComboFix.txt;

5) Não clique na janela do ComboFix, nem feche clicando no X, enquanto a ferramenta estiver sendo executada, pois isto implicará na desconfiguração de seu desktop (ele ficará todo branco);

6) Para parar ou sair do ComboFix, tecle "N";

7) Reabilite o seu anti-vírus;

8) Preciso que você cole o conteúdo do ComboFix.txt em sua próxima resposta.

Abraços.

inuyasharyu · Junho 27, 2008

esta aew o arquivo txt e o pc ñ reiniciou!!

ComboFix 08-06-20.4 - marcos 2008-06-27 16:48:03.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.632 [GMT -3:00]

Executando de: C:\Documents and Settings\marcos\Desktop\ComboFix.exe

* Criado um novo ponto de restauro

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((( Ficheiros criados de 2008-05-27 to 2008-06-27 ))))))))))))))))))))))))))))))))

.

2008-06-27 11:01 . 2008-06-27 11:01 <DIR> d-------- C:\Arquivos de programas\Macromedia

2008-06-27 11:01 . 2008-06-27 11:01 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Vbox

2008-06-27 11:01 . 2008-06-27 11:01 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Macromedia

2008-06-26 17:34 . 2008-06-26 17:34 1,374 --a------ C:\WINDOWS\imsins.BAK

2008-06-26 16:37 . 2008-06-26 16:37 <DIR> d-------- C:\Documents and Settings\marcos\Incomplete

2008-06-25 20:12 . 2008-06-25 20:26 <DIR> d-------- C:\hijackthis

2008-06-25 19:15 . 2008-06-25 19:35 32 --a------ C:\WINDOWS\CD_Start.INI

2008-06-23 16:04 . 2008-06-23 16:35 104,857,600 --a------ C:\BG_Images.part02.rar

2008-06-23 14:24 . 2008-06-23 14:24 <DIR> d-------- C:\Arquivos de programas\Stop Send Safe

2008-06-22 18:43 . 2008-06-22 19:02 104,857,600 --a------ C:\BG_Images.part01.rar

2008-06-22 15:06 . 2008-06-22 15:06 <DIR> d-------- C:\Gamestnt Come See Me Tonight 2

2008-06-22 14:48 . 2008-06-22 14:55 66,116,244 --a------ C:\Gamestnt Come See Me Tonight 2 .rar

2008-06-22 11:44 . 2008-06-22 11:43 8,838 --a------ C:\Beyond+Good+e+Evil+ISO.html

2008-06-19 10:15 . 2008-06-19 10:15 38 --a------ C:\WINDOWS\avisplitter.INI

2008-06-12 07:26 . 2008-06-12 07:27 <DIR> d-------- C:\Arquivos de programas\Valve

2008-06-10 10:56 . 2008-06-10 10:56 <DIR> d-------- C:\Documents and Settings\marcos\Dados de aplicativos\Microsoft Games

2008-06-10 10:56 . 2008-06-10 10:56 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft Games

2008-06-10 10:55 . 2008-06-10 10:55 <DIR> d-------- C:\Arquivos de programas\Microsoft Games

2008-06-10 10:05 . 2008-06-10 10:05 <DIR> d-------- C:\Arquivos de programas\iTunes

2008-06-10 10:05 . 2008-06-10 10:05 <DIR> d-------- C:\Arquivos de programas\iPod

2008-06-10 10:04 . 2008-06-10 10:05 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Apple Computer

2008-06-10 10:04 . 2008-06-10 10:05 <DIR> d-------- C:\Arquivos de programas\QuickTime

2008-06-10 09:59 . 2008-06-10 09:59 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Apple

2008-06-10 09:25 . 2008-06-10 09:25 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Apple

2008-06-10 09:25 . 2008-06-10 09:25 <DIR> d-------- C:\Arquivos de programas\Apple Software Update

2008-06-09 16:48 . 2004-08-03 22:58 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys

2008-06-09 16:48 . 2004-08-03 22:58 5,504 --a--c--- C:\WINDOWS\system32\dllcache\mstee.sys

2008-06-09 15:37 . 2008-06-14 14:59 272,384 --------- C:\WINDOWS\system32\drivers\bthport.sys

2008-06-09 15:37 . 2008-06-14 14:59 272,384 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

2008-06-06 19:44 . 2008-06-06 19:47 <DIR> d-------- C:\Documents and Settings\marcos\Dados de aplicativos\Winamp

2008-06-06 19:44 . 2008-06-06 19:46 <DIR> d-------- C:\Arquivos de programas\Winamp

2008-06-06 19:06 . 2008-06-06 19:06 <DIR> d-------- C:\Arquivos de programas\PluginLetras

2008-06-04 17:09 . 2008-06-04 17:09 <DIR> d-------- C:\Documents and Settings\jogo (marcos)\Dados de aplicativos\Stop Send Safe

2008-06-04 17:07 . 2008-06-04 17:07 <DIR> d-------- C:\Documents and Settings\jogo (marcos)\Dados de aplicativos\MEGAUPLOADTOOLBAR

2008-06-04 17:04 . 2008-06-04 17:04 <DIR> d-------- C:\Documents and Settings\jogo (marcos)\Dados de aplicativos\HP

2008-06-04 17:03 . 2008-04-22 10:31 <DIR> d--h----- C:\Documents and Settings\jogo (marcos)\Modelos

2008-06-04 17:03 . 2008-06-04 17:03 <DIR> dr------- C:\Documents and Settings\jogo (marcos)\Meus documentos

2008-06-04 17:03 . 2008-04-22 07:25 <DIR> dr------- C:\Documents and Settings\jogo (marcos)\Menu Iniciar

2008-06-04 17:03 . 2008-06-04 17:04 <DIR> dr------- C:\Documents and Settings\jogo (marcos)\Favoritos

2008-06-04 17:03 . 2008-06-04 17:07 <DIR> dr-h----- C:\Documents and Settings\jogo (marcos)\Dados de aplicativos

2008-06-04 17:03 . 2008-06-27 16:50 <DIR> d--h----- C:\Documents and Settings\jogo (marcos)\Configurações locais

2008-06-04 17:03 . 2008-04-22 07:25 <DIR> d--h----- C:\Documents and Settings\jogo (marcos)\Ambiente de rede

2008-06-04 17:03 . 2008-04-22 07:25 <DIR> d--h----- C:\Documents and Settings\jogo (marcos)\Ambiente de impressão

2008-06-04 17:03 . 2008-06-04 18:10 <DIR> d-------- C:\Documents and Settings\jogo (marcos)

2008-06-03 14:11 . 2008-06-03 14:12 <DIR> d-------- C:\Arquivos de programas\bmoworld

2008-06-03 09:50 . 2008-06-03 09:50 <DIR> d-------- C:\Arquivos de programas\KAIZEN Games

2008-06-02 19:00 . 2008-06-27 11:01 <DIR> d--h----- C:\Arquivos de programas\InstallShield Installation Information

2008-06-02 18:41 . 2008-06-02 23:10 72,733 --a------ C:\hmb15A4.tmp.jpg

2008-06-02 18:41 . 2008-06-02 23:01 29,233 --a------ C:\ATYAAAArYfMdyPauKx_W6Bh7xbQmYNGlQseuVPoYwa3gy8n183TDOel-GXYFHwqyqtbCVP7h_1l13yTeeafBwEvQDZRAAJtU9VCfr0eaZlAN2y6_bo0pjvP25lPiHQ[1].jpg

2008-06-02 16:51 . 2008-02-15 09:04 578,320,912 --a------ C:\PristonTale4130.exe

2008-06-01 13:18 . 2008-05-19 16:08 478,923,386 --a------ C:\P.S.Eu.Te.Amo.DVDRip.XviD.Mp3.Dublado.[www.therebels.com.br]MariaMonica=2M&P(1).AVI

2008-05-30 18:16 . 2008-05-30 18:16 <DIR> d-------- C:\TABLEAU

2008-05-30 18:14 . 2008-05-30 18:15 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\DVD Shrink

2008-05-29 19:10 . 2008-05-29 19:10 <DIR> d-------- C:\Arquivos de programas\Ares

2008-05-27 10:50 . 2008-05-27 10:50 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx

2008-05-27 10:50 . 2008-05-27 10:50 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-06-27 16:48 --------- d-----w C:\Documents and Settings\marcos\Dados de aplicativos\BitTorrent

2008-06-27 14:01 --------- d-----w C:\Arquivos de programas\Arquivos comuns\InstallShield

2008-06-27 13:56 --------- d-----w C:\Documents and Settings\marcos\Dados de aplicativos\MegauploadToolbar

2008-06-26 19:46 --------- d-----w C:\Documents and Settings\marcos\Dados de aplicativos\LimeWire

2008-06-23 17:26 --------- d-----w C:\Documents and Settings\marcos\Dados de aplicativos\Stop Send Safe

2008-06-23 17:25 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Peak ooze date army

2008-06-17 19:52 --------- d-----w C:\Arquivos de programas\CABAL Online (BRAZIL)

2008-06-10 13:06 --------- d-----w C:\Documents and Settings\marcos\Dados de aplicativos\Apple Computer

2008-06-07 15:46 --------- d-----w C:\Documents and Settings\marcos\Dados de aplicativos\HP

2008-05-25 21:04 --------- d-----w C:\Documents and Settings\marcos\Dados de aplicativos\Uniblue

2008-05-25 21:04 --------- d-----w C:\Arquivos de programas\Uniblue

2008-05-24 11:37 --------- d-----w C:\Arquivos de programas\Sun

2008-05-24 11:37 --------- d-----w C:\Arquivos de programas\Java

2008-05-23 19:19 146,845,691 ----a-w C:\House.S04E06.by.higor.zip

2008-05-23 01:04 --------- d-----w C:\Arquivos de programas\MSXML 4.0

2008-05-21 22:08 --------- d-----w C:\Arquivos de programas\MegauploadToolbar

2008-05-21 13:09 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\HP

2008-05-21 13:09 --------- d-----w C:\Arquivos de programas\HP

2008-05-21 13:09 --------- d-----w C:\Arquivos de programas\Arquivos comuns\HP

2008-05-21 13:06 --------- d-----w C:\Arquivos de programas\Hewlett-Packard

2008-05-21 13:05 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Hewlett-Packard

2008-05-20 18:54 27,496 ----a-w C:\Documents and Settings\marcos\Dados de aplicativos\GDIPFONTCACHEV1.DAT

2008-05-20 14:16 --------- d-----w C:\Arquivos de programas\K-Lite Codec Pack

2008-05-19 00:43 --------- d-----w C:\Documents and Settings\marcos\Dados de aplicativos\Ahead

2008-05-18 16:15 --------- d-----w C:\Arquivos de programas\Dofus

2008-05-18 12:20 --------- d-----w C:\Arquivos de programas\eRightSoft

2008-05-17 12:41 --------- d-----w C:\Arquivos de programas\SystemRequirementsLab

2008-05-12 19:41 --------- d-----w C:\Arquivos de programas\LimeWire

2008-05-12 19:34 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Java

2008-05-12 18:15 --------- d-----w C:\Arquivos de programas\Windows Media Connect 2

2008-05-10 17:11 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Kaspersky Lab

2008-05-09 10:20 --------- d-----w C:\Documents and Settings\marcos\Dados de aplicativos\InterTrust

2008-05-09 10:20 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Adobe

2008-05-09 10:17 --------- d-----w C:\Documents and Settings\marcos\Dados de aplicativos\AdobeUM

2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys

2008-05-07 05:15 1,292,288 ----a-w C:\WINDOWS\system32\quartz.dll

2008-05-06 20:58 --------- d-----w C:\Documents and Settings\marcos\Dados de aplicativos\Aegisub

2008-05-06 20:03 --------- d-----w C:\Arquivos de programas\Windows Live Safety Center

2008-05-04 13:26 --------- d-----w C:\Arquivos de programas\Circle Developement

2008-05-03 14:12 --------- d-----w C:\Arquivos de programas\GameVicio

2008-05-03 12:34 --------- d-----w C:\Arquivos de programas\EA GAMES

2008-05-03 12:03 --------- d-----w C:\Arquivos de programas\D-Tools

2008-05-01 17:04 --------- d-----w C:\Arquivos de programas\Google

2008-04-30 20:27 442,368 ----a-w C:\WINDOWS\system32\NVUNINST.EXE

2008-04-27 01:51 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy

2008-04-27 01:48 --------- d-----w C:\Arquivos de programas\Spybot - Search & Destroy

2008-04-27 01:41 --------- d-----w C:\Documents and Settings\marcos\Dados de aplicativos\Lavasoft

2008-04-27 01:26 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Yahoo! Companion

2008-04-27 01:26 --------- d-----w C:\Arquivos de programas\Yahoo!

2008-04-27 01:26 --------- d-----w C:\Arquivos de programas\CCleaner

2008-04-24 20:39 2,887,680 ----a-w C:\WINDOWS\system32\VagalumePluginWMP.dll

2008-04-23 07:14 826,368 ----a-w C:\WINDOWS\system32\wininet.dll

2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll

2007-02-21 11:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll

2007-12-17 13:43 27,648 --sh--w C:\WINDOWS\system32\Smab0.dll

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

REGEDIT4

*Nota* entradas vazias & legítimas por defeito não são mostradas.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe" [2006-09-13 11:12 139264]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:00 15360]

"Wipe Htm"="C:\DOCUME~1\marcos\DADOSD~1\STOPSE~1\gplfaceinternet.exe" [2008-06-23 14:24 569344]

"swg"="C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-10 13:16 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Acrobat Assistant 7.0"="C:\Arquivos de programas\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 02:08 483328]

"NeroFilterCheck"="C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648]

"DAEMON Tools-1033"="C:\Arquivos de programas\D-Tools\daemon.exe" [2004-08-22 17:05 81920]

"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 22:32 208952]

"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 22:31 59392]

"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 22:32 455168]

"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 22:32 455168]

"avast!"="C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-15 20:19 79224]

"SunJavaUpdateSched"="C:\Arquivos de programas\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]

"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]

"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]

"HP Software Update"="C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41 49152]

"QuickTime Task"="C:\Arquivos de programas\QuickTime\qttask.exe" [2008-05-27 10:50 413696]

"iTunesHelper"="C:\Arquivos de programas\iTunes\iTunesHelper.exe" [2008-06-02 11:13 267048]

"Date Army Wma Spam"="C:\Documents and Settings\All Users\Dados de aplicativos\Peak ooze date army\Bows Aim.exe" [2008-06-27 10:41 1430528]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 09:00 15360]

C:\Documents and Settings\marcos\Menu Iniciar\Programas\Inicializar\

Adobe Gamma.lnk - C:\Arquivos de programas\Arquivos comuns\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 113664]

C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\

Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2008-04-22 15:40:44 25214]

HP Digital Imaging Monitor.lnk - C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 04:21:22 288472]

Microsoft Office.lnk - C:\Arquivos de programas\Microsoft Office\Office10\OSA.EXE [2001-02-13 09:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=C:\ARQUIV~1\KASPER~1\KASPER~1.0\kloehk.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.I420"= i420vfw.dll

"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]

-rahs---- 2008-01-28 11:43 2097488 C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Arquivos de programas\\BitTorrent\\bittorrent.exe"=

"C:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"=

"C:\\Arquivos de programas\\Bonjour\\mDNSResponder.exe"=

"C:\\Arquivos de programas\\LimeWire\\LimeWire.exe"=

"C:\\Arquivos de programas\\CABAL Online (BRAZIL)\\cabal.exe"=

"C:\\Arquivos de programas\\CABAL Online (BRAZIL)\\launcher\\update\\ESTdnheadless.exe"=

"C:\\Arquivos de programas\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"=

"C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"C:\\Arquivos de programas\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"C:\\Arquivos de programas\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"C:\\Arquivos de programas\\Messenger\\msmsgs.exe"=

"C:\\Arquivos de programas\\Ares\\Ares.exe"=

"C:\\Arquivos de programas\\bmoworld\\BomberMan.exe"=

"C:\\Arquivos de programas\\iTunes\\iTunes.exe"=

"C:\\Arquivos de programas\\Microsoft Games\\Zoo Tycoon 2\\zt.exe"=

"C:\\Arquivos de programas\\Mozilla Firefox\\firefox.exe"=

"C:\\Arquivos de programas\\Valve\\hl.exe"=

"C:\\Arquivos de programas\\Internet Explorer\\iexplore.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-15 20:20]

R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-15 20:16]

S3 XDva081;XDva081;C:\WINDOWS\system32\XDva081.sys []

S3 XDva134;XDva134;C:\WINDOWS\system32\XDva134.sys []

S3 XDva165;XDva165;C:\WINDOWS\system32\XDva165.sys []

S3 XDva172;XDva172;C:\WINDOWS\system32\XDva172.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9ef00de3-2109-11dd-bc57-00022ad46562}]

\Shell\AutoRun\command - fooool.exe

\Shell\explore\Command - fooool.exe

\Shell\open\Command - fooool.exe

*Newly Created Service* - CATCHME

.

Conteúdo da pasta 'Tarefas Agendadas'

"2008-06-27 19:00:00 C:\WINDOWS\Tasks\ACE9F48E918A66A6.job"

- c:\docume~1\marcos\dadosd~1\stopse~1\Link Vga Browse.exe

"2008-06-24 01:36:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"

- C:\Arquivos de programas\Apple Software Update\SoftwareUpdate.exe

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-06-27 16:51:25

Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros ocultos ...

Varredura completada com sucesso

Ficheiros ocultos: 0

**************************************************************************

.

Tempo para conclusão: 2008-06-27 16:54:54

ComboFix-quarantined-files.txt 2008-06-27 19:54:33

Pre-Run: 185,438,060,544 bytes disponíveis

Post-Run: 185,556,140,032 bytes disponíveis

233 --- E O F --- 2008-06-27 03:09:20

jgarcia · Julho 1, 2008

Opa inuyasharyu,

Siga as instruções:

1. Abra o Bloco de Notas -> Copie (Control + C) e Cole (Control + V) todo o texto incluído no "Quote":

File::
C:\ATYAAAArYfMdyPauKx_W6Bh7xbQmYNGlQseuVPoYwa3gy8n183TDOel-GXYFHwqyqtbCVP7h_1l13yTeeafBwEvQDZRAAJtU9VCfr0eaZlAN2y6_bo0pjvP25lPiHQ[1].jpg

C:\Documents and Settings\marcos\Dados de aplicativos\GDIPFONTCACHEV1.DAT

C:\Documents and Settings\All Users\Dados de aplicativos\Peak ooze date army\Bows Aim.exe

C:\DOCUME~1\marcos\DADOSD~1\STOPSE~1\gplfaceinternet.exe

c:\docume~1\marcos\dadosd~1\stopse~1\Link Vga Browse.exe

C:\WINDOWS\Tasks\ACE9F48E918A66A6.job

C:\WINDOWS\imsins.BAK

C:\hmb15A4.tmp.jpg

Folder::

C:\Arquivos de programas\Stop Send Safe

C:\DOCUME~1\marcos\DADOSD~1\STOPSE~1

C:\Documents and Settings\marcos\Dados de aplicativos\Stop Send Safe

C:\Documents and Settings\All Users\Dados de aplicativos\Peak ooze date army

Registry::

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Wipe Htm"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Date Army Wma Spam"=-

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000000

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9ef00de3-2109-11dd-bc57-00022ad46562}]

ATENÇÃO: O script acima foi elaborado especifícamente para a infecção contida neste computador. Utilizá-lo em outra máquina poderá originar graves problemas ao usuário.

2. Salve o arquivo como CFScript.txt;

3. Tal como exemplificado na foto abaixo, arraste o arquivo CFScript.txt para o ComboFix.exe.

4. Ao término do processo a ferramenta irá gerar um log. Poste-o (C:\ComboFix.txt) em sua próxima resposta, juntamente com um novo log do HijackThis.

Abraços.

inuyasharyu · Julho 1, 2008

depois de tentar por o log do combo fix aqui, ele é muiito grande e me ferre na hora de por por isso eu upei ele e pus aqui para download

http://www.badongo.com/file/10160682

so baixar ele

inuyasharyu · Julho 1, 2008

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 09:15:51, on 1/7/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Arquivos de programas\Bonjour\mDNSResponder.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\Arquivos de programas\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

C:\Arquivos de programas\D-Tools\daemon.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\Arquivos de programas\Java\jre1.6.0_05\bin\jusched.exe

C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

C:\Arquivos de programas\iTunes\iTunesHelper.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexStoreSvr.exe

C:\Arquivos de programas\iPod\bin\iPodService.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Arquivos de programas\Windows Live\Messenger\usnsvc.exe

C:\WINDOWS\explorer.exe