[Arquivado] Acho que ficaram sequelas no meu PC

Quinho Knupp (Ber)²t · Julho 28, 2008

Hello... eu pedi ajuda em um tópico aki no imasters e retirei os malwares, trojnas e outros problemas q tinham no meu pc... mas ficou com sequelas meu pc... eu naum consigo usar o programa Ares e alguns sites q requerem flash naum estão abrindo... c alguém puder me ajudar agradeço!!!!!!!!!!!!

Logfile of HijackThis v1.99.1

Scan saved at 16:28:09, on 28/7/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccSvcHst.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\AppCore\AppSvc32.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\Arquivos de programas\Bonjour\mDNSResponder.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\system32\cmpe.exe

C:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBService.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\IoctlSvc.exe

c:\Arquivos de programas\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\WINDOWS\system32\svchost.exe

C:\ARQUIV~1\TRISNA~1\SSI\SYSENF~1.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Arquivos de programas\Oi Velox\Manager\desp2k.exe

C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccApp.exe

C:\WINDOWS\vsnpstd3.exe

C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Arquivos de programas\RocketDock\RocketDock.exe

C:\Arquivos de programas\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Arquivos de programas\Windows Live\Messenger\usnsvc.exe

C:\Arquivos de programas\Windows Media Player\wmplayer.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Arquivos de programas\Opera\opera.exe

C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orkut.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\coShared\Browser\1.5\NppBho.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\ARQUIV~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL

O2 - BHO: CompSegIB - {2E3C3651-B19C-4DD9-A979-901EC3E930AF} - C:\Arquivos de programas\Scpad\scpsssh2.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\ARQUIV~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar1.dll

O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\coShared\Browser\1.5\UIBHO.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar1.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [desp2k] C:\Arquivos de programas\Oi Velox\Manager\desp2k.exe

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [ccApp] C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccApp.exe

O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [Conexão Oi Velox] "C:\Arquivos de programas\Oi Velox\Conexão\pppoe.exe"

O4 - HKCU\..\Run: [RocketDock] "C:\Arquivos de programas\RocketDock\RocketDock.exe"

O4 - HKCU\..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\ARQUIV~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\arquivos de programas\bonjour\mdnsnsp.dll

O11 - Options group: [iNTERNATIONAL] International*

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/PT-BR/a-UNO1/GAME_UNO1.cab

O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/...lscbase5036.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1214361483687

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{2CA565DE-3C8E-4729-A75A-CB93CED9B6D1}: NameServer = 200.149.55.142 200.165.132.154

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\ARQUIV~1\MICROS~2\Office12\GR99D3~1.DLL

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\ARQUIV~1\ARQUIV~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O21 - SSODL: CompIBBrd - {A3717295-941D-416F-9384-ED1736729F1C} - C:\Arquivos de programas\Scpad\scpLIB.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Arquivos de programas\Arquivos comuns\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Arquivos de programas\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Arquivos de programas\Bonjour\mDNSResponder.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)

O23 - Service: Context Manager Process Extension (cmpe) - LightComm - C:\WINDOWS\system32\cmpe.exe

O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\VAScanner\comHost.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Arquivos de programas\Norton Internet Security\isPwdSvc.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\ARQUIV~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Arquivos de programas\Arquivos comuns\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)

O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Arquivos de programas\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)

O23 - Service: SQL Server (SONY_MEDIAMGR2) (MSSQL$SONY_MEDIAMGR2) - Unknown owner - c:\Arquivos de programas\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSONY_MEDIAMGR2 (file missing)

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Nero\Lib\NMIndexingService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Arquivos de programas\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\AppCore\AppSvc32.exe

O23 - Service: SysEnforce - Unknown owner - C:\ARQUIV~1\TRISNA~1\SSI\SYSENF~1.EXE

aí está o meu log caso seja preciso!!!!!!!!!!!

DigRam · Julho 28, 2008

Boa Noite! Quinho Knupp ( Be...

>@< Faça um scan on line em: < Kaspersky >

<!> Acesse o site, clique em: < >

>@< Na próxima página,clique em: I Accept

>@< Isto,para que se instale o controle activeX e,em seguida,atualize o banco de dados.

>@< Na próxima página,clique em: My Computer e faça o scan.

>@< Tenha paciência! Aguarde a atualização da base de dados,e o próprio exame que é demorado.

>@< Terminando,salve e poste o relatório.

Abraços!

Quinho Knupp (Ber)²t · Julho 31, 2008

Aki está o log...

KASPERSKY ONLINE SCANNER 7 REPORT

Thursday, July 31, 2008

Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)

Kaspersky Online Scanner 7 version: 7.0.25.0

Program database last update: Thursday, July 31, 2008 00:31:04

Records in database: 1031689

Scan settings

Scan using the following database extended

Scan archives yes

Scan mail databases yes

Scan area My Computer

A:\

C:\

D:\

E:\

G:\

Scan statistics

Files scanned 90190

Threat name 18

Infected objects 35

Suspicious objects 0

Duration of the scan 02:40:39

File name Threat name Threats count

C:\Arquivos de programas\Navilog1\reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1

C:\Documents and Settings\Administrador\Meus documentos\Downloads\aresflashdownloader.exe Infected: not-a-virus:AdWare.Win32.Relevant.a 1

C:\Documents and Settings\Administrador\Meus documentos\Downloads\dojo.exe Infected: not-a-virus:RiskTool.Win32.Squnsh.b 1

C:\Documents and Settings\Administrador\Meus documentos\Downloads\iMeshV3.exe Infected: not-a-virus:AdWare.Win32.SideStep.e 1

C:\Documents and Settings\Administrador\Meus documentos\Downloads\iMeshV3.exe Infected: not-a-virus:AdWare.Win32.CommonName.p 1

C:\Documents and Settings\Administrador\Meus documentos\Downloads\iMeshV3.exe Infected: not-a-virus:AdWare.Win32.Cydoor 2

C:\Documents and Settings\Administrador\Meus documentos\Downloads\iMeshV3.exe Infected: not-a-virus:AdWare.Win32.EZula.d 1

C:\Documents and Settings\Administrador\Meus documentos\Downloads\iMeshV3.exe Infected: not-a-virus:AdWare.Win32.NewDotNet 1

C:\Documents and Settings\Administrador\Meus documentos\Downloads\iMeshV3.exe Infected: not-a-virus:AdWare.Win32.Gator.3202 1

C:\Documents and Settings\Administrador\Meus documentos\Downloads\limewire_download_accelerator_pro.exe Infected: not-a-virus:AdWare.Win32.NewDotNet 1

C:\Documents and Settings\Administrador\Meus documentos\Downloads\Multimídia\Codec\GDiVX1.9.5.exe Infected: not-a-virus:AdWare.Win32.SaveNow.ar 1

C:\Documents and Settings\Administrador\Meus documentos\Downloads\Multimídia\Codec\GDiVX1.9.5.exe Infected: not-a-virus:AdWare.Win32.NewDotNet 1

C:\Documents and Settings\Administrador\Meus documentos\Downloads\Nero\Nero-8.3.2.1_ptb_trial.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm 1

C:\Documents and Settings\Administrador\Meus documentos\Downloads\Segurança\clean.zip Infected: not-a-virus:RiskTool.Win32.PsKill.k 1

C:\Documents and Settings\Administrador\Meus documentos\Downloads\Segurança\Navilog1.zip Infected: not-a-virus:RiskTool.Win32.Reboot.f 1

C:\Documents and Settings\Administrador\Meus documentos\Downloads\Vista Transformation Pack 6.0 RC1.exe Infected: not-a-virus:RiskTool.Win32.CloseApp.a 2

C:\Documents and Settings\Administrador\Meus documentos\Downloads\vtp6_rc1.zip Infected: not-a-virus:RiskTool.Win32.CloseApp.a 2

C:\Documents and Settings\Administrador\Meus documentos\Edição de Vídeo\Vegas\Plugin\NewBlue_FX_pack_for_Vegas\NewBlue3DExplosionsVegasSetup10.exe Infected: not-a-virus:AdWare.Win32.EShoper.al 1

C:\Documents and Settings\Administrador\Meus documentos\Edição de Vídeo\Vegas\Plugin\NewBlue_FX_pack_for_Vegas\NewBlueArtEffectsVegasSetup20.exe Infected: not-a-virus:AdWare.Win32.EShoper.m 1

C:\Documents and Settings\Administrador\Meus documentos\Edição de Vídeo\Vegas\Plugin\NewBlue_FX_pack_for_Vegas\NewBlueMotionBlendsVegasSetup20.exe Infected: not-a-virus:AdWare.Win32.EShoper.am 1

C:\Documents and Settings\Administrador\Meus documentos\Edição de Vídeo\Vegas\Plugin\NewBlue_FX_pack_for_Vegas.rar Infected: not-a-virus:AdWare.Win32.EShoper.al 1

C:\Documents and Settings\Administrador\Meus documentos\Edição de Vídeo\Vegas\Plugin\NewBlue_FX_pack_for_Vegas.rar Infected: not-a-virus:AdWare.Win32.EShoper.m 1

C:\Documents and Settings\Administrador\Meus documentos\Edição de Vídeo\Vegas\Plugin\NewBlue_FX_pack_for_Vegas.rar Infected: not-a-virus:AdWare.Win32.EShoper.am 1

C:\Documents and Settings\Administrador\Meus documentos\Meus arquivos recebidos\CrackXp.rar Infected: not-a-virus:PSWTool.Win32.RAS.a 3

C:\Documents and Settings\Administrador\Meus documentos\Meus arquivos recebidos\Crack_Windows_XP_SP2.zip Infected: not-a-virus:PSWTool.Win32.RAS.a 2

C:\Documents and Settings\Administrador\Meus documentos\Meus arquivos recebidos\Validar Windows XP Como Original.rar Infected: not-a-virus:PSWTool.Win32.RAS.a 2

C:\Navilog1\Navilog1.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1

C:\QooBox\Quarantine\C\WINDOWS\system32\pntcbogt.dll.vir Infected: Trojan-Downloader.Win32.Delf.jvh 1

The selected area was scanned.

Obrigado desde já!

DigRam · Julho 31, 2008

Bom Dia! Quinho Knupp ( Be...

<!> As indicações de infecções,estão relacionadas a programas P2Ps. ( iMeshV3 )

<!> Remova seu instalador e baixe programas que não venham infectados.

<!> Escolha,aqui,o seu programa P2P: < Testes com adwares em programas P2P >

-----------------------------

<@> BAIXE: < Kaspersky Virus Removal Tool >

-----------------------------

<@> Faça o download da atualização mais recente! << Observe as datas!

<@> Salve-o em Arquivos de Programas!

<@> Reinicie o computador,em Modo de Segurança! << Importante!

<@> Execute a ferramenta,com um duplo-clique,em seu executável.

<@> Abrir-se-á a seguinte janela:

<@> Na opção: Manual Cure,marque todas as caixas e clique em Scan.

<@> Terminando o scan,copie e poste o relatório.

Ps: Confirme a solicitação de remoção,aos arquivos detectados!

Abraços!

Quinho Knupp (Ber)²t · Agosto 5, 2008

O log é gigantesco, naum tem como colar aki... oq eu faço?! Na opção manual cure naum tinha nenhuma caixa pra marcar... eu fiz o automatic scan... mas o lgo é gigantesco!

DigRam · Agosto 5, 2008

O log é gigantesco, naum tem como colar aki... oq eu faço?! Na opção manual cure naum tinha nenhuma caixa pra marcar... eu fiz o automatic scan... mas o lgo é gigantesco!

------------------------

Opa! Quinho Knupp ( Ber..

Boa Tarde!

<!> Copie,apenas,a parte do log que relaciona as infecções detectadas! :thumbsup:

Abraços!

Quinho Knupp (Ber)²t · Agosto 8, 2008

Ta aí o Log:

Scan

----

Scanned: 814051

Detected: 25

Untreated: 0

Start time: 5/8/2008 00:17:10

Duration: 11:42:32

Finish time: 5/8/2008 11:59:42

Detected

--------

Status Object

------ ------

deleted: adware not-a-virus:AdWare.Win32.EShoper.bc File: C:\Documents and Settings\Administrador\Meus documentos\Downloads\ispd.exe

deleted: riskware not-a-virus:AdTool.Win32.MyWebSearch.bm File: C:\Documents and Settings\Administrador\Meus documentos\Downloads\Nero\Nero-8.3.2.1_ptb_trial.exe//Toolbar.exe

deleted: riskware not-a-virus:RiskTool.Win32.PsKill.k File: C:\Documents and Settings\Administrador\Meus documentos\Downloads\Segurança\clean.zip/clean/pskill.exe

deleted: riskware not-a-virus:RiskTool.Win32.Reboot.f File: C:\Documents and Settings\Administrador\Meus documentos\Downloads\Segurança\Navilog1.zip/Navilog1.exe//file11

deleted: adware not-a-virus:AdWare.Win32.EShoper.al File: C:\Documents and Settings\Administrador\Meus documentos\Edição de Vídeo\Vegas\Plugin\NewBlue_FX_pack_for_Vegas.rar/NewBlue_FX_pack_for_Vegas\NewBlue3DExplosionsVegasSetup10.exe

deleted: adware not-a-virus:AdWare.Win32.EShoper.m File: C:\Documents and Settings\Administrador\Meus documentos\Edição de Vídeo\Vegas\Plugin\NewBlue_FX_pack_for_Vegas.rar/NewBlue_FX_pack_for_Vegas\NewBlueArtEffectsVegasSetup20.exe

deleted: adware not-a-virus:AdWare.Win32.EShoper.am File: C:\Documents and Settings\Administrador\Meus documentos\Edição de Vídeo\Vegas\Plugin\NewBlue_FX_pack_for_Vegas.rar/NewBlue_FX_pack_for_Vegas\NewBlueMotionBlendsVegasSetup20.exe

deleted: adware not-a-virus:AdWare.Win32.EShoper.al File: C:\Documents and Settings\Administrador\Meus documentos\Edição de Vídeo\Vegas\Plugin\NewBlue_FX_pack_for_Vegas\NewBlue3DExplosionsVegasSetup10.exe

deleted: adware not-a-virus:AdWare.Win32.EShoper.m File: C:\Documents and Settings\Administrador\Meus documentos\Edição de Vídeo\Vegas\Plugin\NewBlue_FX_pack_for_Vegas\NewBlueArtEffectsVegasSetup20.exe

deleted: adware not-a-virus:AdWare.Win32.EShoper.am File: C:\Documents and Settings\Administrador\Meus documentos\Edição de Vídeo\Vegas\Plugin\NewBlue_FX_pack_for_Vegas\NewBlueMotionBlendsVegasSetup20.exe

deleted: riskware not-a-virus:PSWTool.Win32.RAS.a File: C:\Documents and Settings\Administrador\Meus documentos\Meus arquivos recebidos\CrackXp.rar/Validar Windows XP Como Original.rar/Validar Windows XP Como Original\WinXP keyChanger.exe/xpkey.exe

deleted: riskware not-a-virus:PSWTool.Win32.RAS.a File: C:\Documents and Settings\Administrador\Meus documentos\Meus arquivos recebidos\CrackXp.rar/Validar Windows XP Como Original.rar/Validar Windows XP Como Original\WinXP keyChanger.exe/officekey.exe

deleted: riskware not-a-virus:PSWTool.Win32.RAS.a File: C:\Documents and Settings\Administrador\Meus documentos\Meus arquivos recebidos\CrackXp.rar/Crack_Windows_XP_SP2.zip/Crack_Windows_XP_SP2/WinXP keyChanger.exe

disinfected: riskware not-a-virus:PSWTool.Win32.RAS.a File: C:\Documents and Settings\Administrador\Meus documentos\Meus arquivos recebidos\Crack_Windows_XP_SP2.zip

disinfected: riskware not-a-virus:PSWTool.Win32.RAS.a File: C:\Documents and Settings\Administrador\Meus documentos\Meus arquivos recebidos\Validar Windows XP Como Original.rar

deleted: riskware not-a-virus:RiskTool.Win32.Reboot.f File: C:\Arquivos de programas\Navilog1\reboot.exe

deleted: Trojan program Trojan.Win32.Obfuscated.gen File: C:\Lop SD\Backup-Lop\DOCUME~1\ADMINI~1\DADOSD~1\SPAMDE~1\NURBLIES.exe

deleted: Trojan program Trojan.Win32.Obfuscated.gen File: C:\Lop SD\Backup-Lop\DOCUME~1\ADMINI~1\DADOSD~1\SPAMDE~1\spmptsvm.exe

deleted: Trojan program Trojan.Win32.Obfuscated.gen File: C:\Lop SD\Backup-Lop\DOCUME~1\ADMINI~1\DADOSD~1\SPAMDE~1\storecoolsend.exe

deleted: Trojan program Trojan.Win32.Obfuscated.gen File: C:\Lop SD\Backup-Lop\DOCUME~1\ADMINI~1\DADOSD~1\SPAMDE~1\WebJunkEachBait.exe

deleted: Trojan program Trojan.Win32.Obfuscated.gen File: C:\Lop SD\Backup-Lop\DOCUME~1\ADMINI~1\DADOSD~1\SPAMDE~1\yvrxdaaq.exe

deleted: Trojan program Trojan.Win32.Obfuscated.gen File: C:\Lop SD\Backup-Lop\DOCUME~1\ALLUSE~1\DADOSD~1\Axis Readme Second Bat\pure peak.exe

deleted: riskware not-a-virus:RiskTool.Win32.Reboot.f File: C:\Navilog1\Navilog1.exe//file11

deleted: Trojan program Trojan-Downloader.Win32.Delf.jvh File: C:\QooBox\Quarantine\C\WINDOWS\system32\pntcbogt.dll.vir

deleted: riskware not-a-virus:RiskTool.Win32.Reboot.f File: C:\Navilog1\Navilog1.exe

Obrigado!!!!!!!!!

DigRam · Agosto 8, 2008

Bom Dia! Quinho Knupp ( Be...

<@> Baixe: < >

< ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe >

<@> Salve-o no Desktop!

<@> Execute o arquivo: drweb-cureit.exe

<@> Clique em Iniciar e escolha a verificação express scan.

<@> Se for encontrado,algum ficheiro infectado,clique no botão yes,para acionar a cura.

<@> Quando o scan rápido terminar,clique em Opções --> Alterar Definições.

<@> Na aba Verificação,desmarque a Análise Heurística e confirme!

<@> De volta à janela principal,marque os drives que você deseja examinar.

<@> Selecione todos! Um ponto vermelho,vai indicar os drives selecionados.

<@> Clique na seta verde,para iniciar o exame.

< >

<@> Caso haja uma solicitação,para curar/mover o arquivo,clique em Sim para todos.

<@> Quando o exame terminar,observe se o ícone "objetos encontrados" < > está habilitado.

<@> Se estiver,clique nele!

<@> Á seguir clique no ícone,logo abaixo,e selecione Mover incuráveis.

< >

<@> Caso o programa não possa curá-los,ele irá movê-los para a pasta Quarentena,no diretório DoctorWeb.

<@> Feito isto, vá no menu superior e clique na opção Ficheiros --> Guardar listas de arquivos.

<@> Salve a lista no desktop. ( DrWeb.csv ) <-- Relatório!

<@> Feche o programa!

<@> Reinicie o computador,para que o programa termine de deletar/mover,os arquivos que estavam sendo utilizados.

Abraços!

Quinho Knupp (Ber)²t · Agosto 8, 2008

scplib.dll c:\arquivos de programas\scpad Provavelmente BACKDOOR.Trojan Incurável.Será eliminado após reiniciar o sistema.

scpmib.dll c:\arquivos de programas\scpad Provavelmente DLOADER.Trojan Incurável.Eliminado.

Aí está o log... obrigado!

DigRam · Agosto 8, 2008

scplib.dll c:\arquivos de programas\scpad Provavelmente BACKDOOR.Trojan Incurável.Será eliminado após reiniciar o sistema.
scpmib.dll c:\arquivos de programas\scpad Provavelmente DLOADER.Trojan Incurável.Eliminado.

Aí está o log... obrigado!

----------------------

Opa! Quinho Knupp (Be...

<!> Poste um novo log do HijackThis! :thumbsup:

Abraços!

Quinho Knupp (Ber)²t · Agosto 11, 2008

Hellooooo... estou aki novamtene... aki esta o lgo:

Logfile of HijackThis v1.99.1

Scan saved at 13:58:58, on 11/8/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccSvcHst.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\AppCore\AppSvc32.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\Arquivos de programas\Oi Velox\Manager\desp2k.exe

C:\WINDOWS\vsnpstd3.exe

C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccApp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\RocketDock\RocketDock.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Arquivos de programas\Symantec\LiveUpdate\AluSchedulerSvc.exe

C:\Arquivos de programas\Bonjour\mDNSResponder.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\system32\cmpe.exe

C:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBService.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\IoctlSvc.exe

C:\WINDOWS\system32\HPZipm12.exe

c:\Arquivos de programas\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\WINDOWS\system32\svchost.exe

C:\ARQUIV~1\TRISNA~1\SSI\SYSENF~1.EXE

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Windows Live\Messenger\usnsvc.exe

C:\Arquivos de programas\Windows Media Player\wmplayer.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Documents and Settings\Administrador\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.orkut.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\coShared\Browser\1.5\NppBho.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\ARQUIV~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL

O2 - BHO: CompSegIB - {2E3C3651-B19C-4DD9-A979-901EC3E930AF} - C:\Arquivos de programas\Scpad\scpsssh2.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Arquivos de programas\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\ARQUIV~1\MEGAUP~1\MEGAUP~1.DLL

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\ARQUIV~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar1.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar1.dll

O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\ARQUIV~1\MEGAUP~1\MEGAUP~1.DLL

O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\coShared\Browser\1.5\UIBHO.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [desp2k] C:\Arquivos de programas\Oi Velox\Manager\desp2k.exe

O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [ccApp] "C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [osCheck] "C:\Arquivos de programas\Norton Internet Security\osCheck.exe"

O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [RocketDock] "C:\Arquivos de programas\RocketDock\RocketDock.exe"

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background

O8 - Extra context menu item: Add to AMV Converter... - C:\Arquivos de programas\MP3 Player Utilities 4.15\AMVConverter\grab.html

O8 - Extra context menu item: Baixar Link Utiizando Gerenciador Mega... - C:\Arquivos de programas\Megaupload\Mega Manager\mm_file.htm

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Arquivos de programas\MP3 Player Utilities 4.15\MediaManager\grab.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll