[Resolvido!]Analisem meu log

Nilson N · Agosto 10, 2008

Meu PC está com uma fraude para atualização da chave de segurança do Bradesco

A tela falsa do Bradesco que aparece é parecida com esta: http://www.bradescoseguranca.com.br/html/c...to=0&dica=1

Logfile of HijackThis v1.99.1

Scan saved at 09:15:24, on 10/8/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmgr.exe

C:\ARQUIV~1\AVG\AVG8\avgtray.exe

C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmon.exe

C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wdfmgr.exe

C:\ARQUIV~1\AVG\AVG8\avgam.exe

C:\ARQUIV~1\AVG\AVG8\avgrsx.exe

C:\ARQUIV~1\AVG\AVG8\avgnsx.exe

C:\ARQUIV~1\AVG\AVG8\avgemc.exe

C:\WINDOWS\System32\alg.exe

C:\Arquivos de programas\AVG\AVG8\avgscanx.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\ARQUIV~1\GbPlugin\GbpSv.exe

C:\Arquivos de programas\AVG\AVG8\avgui.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\DOCUME~1\Nildo\CONFIG~1\Temp\Rar$EX00.891\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ig.com.br/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Arquivos de programas\Orbitdownloader\orbitcth.dll

O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: CompSegIB - {2E3C3651-B19C-4DD9-A979-901EC3E930AF} - C:\Arquivos de programas\Scpad\scpsssh2.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG8\avgssie.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\Arquivos de programas\GbPlugin\gbieh.dll

O2 - BHO: G-Buster Browser Defense ABN AMRO - {C41A1C0E-EA6C-11D4-B1B8-444553540007} - C:\ARQUIV~1\GbPlugin\gbiehabn.dll

O2 - BHO: (no name) - {FCADDC14-BD46-408A-9842-CDBE1C6D37EB} - C:\WINDOWS\iexplorer.dll

O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmgr.exe"

O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARQUIV~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [smartDefrag] "C:\Arquivos de programas\Manutenção\IObit SmartDefrag\IObit SmartDefrag.exe" /StartUp

O4 - HKLM\..\Run: [MSMSGS] C:\WINDOWS\msmsgs.exe /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O8 - Extra context menu item: &Download by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/201

O8 - Extra context menu item: &Grab video by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/204

O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/203

O8 - Extra context menu item: Down&load all by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/202

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1215210244078

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1215224552281

O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399007} (GbPluginObj Class) - https://wwws.realsecureweb.com.br/mpr/plugi...GbPluginABN.cab

O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://download.gamedesire.com/g_bin/eng/b...d8_2_0_0_35.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Arquivos de programas\AVG\AVG8\avgpp.dll

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O20 - AppInit_DLLs: avgrsstx.dll

O20 - Winlogon Notify: GbPluginAbn - C:\ARQUIV~1\GbPlugin\gbiehabn.dll

O20 - Winlogon Notify: GbPluginBb - C:\Arquivos de programas\GbPlugin\gbieh.dll

O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)

O21 - SSODL: CompIBBrd - {A3717295-941D-416F-9384-ED1736729F1C} - C:\Arquivos de programas\Scpad\scpLIB.dll

O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

DigRam · Agosto 10, 2008

Bom Dia! Nilson N

<@> Baixe: < ComboFix.exe >

<@> Salve-o no Desktop!

<@> Desabilite as proteções residente de: antivírus,antispywares e Firewall.( Menos o do Windows! )

<@> Feche todas as janelas e execute a ferramenta!

Caso aconteça a notificação de: Aplicativo Win32 inválido,delete a ferramenta e faça,novamente,o download.
Salve-a no Desktop,renomeada como: Kombo.exe

Ps: Nomeie durante o salvamento,e não após salvá-la!

Ps: Caso ocorra alguma mensagem de erro,rode o ComboFix em Modo de Segurança.

<@> Abrirá a janela Auto Scan. Aguarde!

<@> Digite a opção para continuar e < Enter >

<@> Aguarde a conclusão! Durante o scan,evite tocar no mouse ou teclado!

<@> Para parar ou sair do ComboFix,tecle "N".

----------------------

<@> Poste o relatório: C:\ComboFix.txt,na sua resposta + Log do HJT,atualizado.

Abraços!

Nilson N · Agosto 10, 2008

Bom dia, DigRam. Agradeço desde já!

ComboFix 08-08-09.06 - Nildo 2008-08-10 10:32:40.1 - NTFSx86 MINIMAL

Executando de: C:\Documents and Settings\Nildo\Desktop\Kombo.exe

ATENÇAO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !!

.

((((((((((((((((((((((( Ficheiros criados de 2008-07-10 to 2008-08-10 ))))))))))))))))))))))))))))))))

.

2008-08-10 10:31 . 2008-08-10 10:32 <DIR> d-------- C:\327882R2FWJFW

2008-08-10 09:03 . 2008-08-10 09:03 <DIR> d-------- C:\!KillBox

2008-08-09 11:12 . 2008-08-09 21:58 3,388 --a------ C:\WINDOWS\wlm.dat

2008-08-09 10:57 . 2008-08-09 10:57 8,516 --a------ C:\WINDOWS\smtp2.dat

2008-08-09 10:57 . 2008-08-09 10:57 1,639 --a------ C:\WINDOWS\msn.dat

2008-08-09 10:57 . 2008-08-09 10:57 474 --a------ C:\WINDOWS\http.dat

2008-08-09 10:57 . 2008-08-09 10:57 2 --a------ C:\WINDOWS\tcefni.dat

2008-08-09 10:56 . 2008-08-09 10:56 240,443 --a------ C:\WINDOWS\msmsgs.exe

2008-08-09 10:27 . 2008-08-09 10:28 632,195 --a------ C:\WINDOWS\iexplorer.dll

2008-08-03 10:39 . 2008-08-03 10:40 <DIR> d-------- C:\Arquivos de programas\SopCast

2008-08-03 10:39 . 2008-08-09 20:22 <DIR> d-------- C:\Arquivos de programas\Megacubo

2008-08-03 09:56 . 2008-08-03 09:56 <DIR> d-------- C:\Arquivos de programas\PHP Editor

2008-07-31 22:11 . 2008-08-02 12:52 <DIR> d-------- C:\Documents and Settings\Nildo\Dados de aplicativos\Ahead

2008-07-29 11:09 . 2008-08-02 08:23 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy

2008-07-29 11:09 . 2008-07-29 12:50 <DIR> d-------- C:\Arquivos de programas\Windows Desktop Search

2008-07-29 11:07 . 2008-03-07 14:02 192,000 -----c--- C:\WINDOWS\system32\dllcache\offfilt.dll

2008-07-29 11:07 . 2008-03-07 14:02 98,304 -----c--- C:\WINDOWS\system32\dllcache\nlhtml.dll

2008-07-29 11:07 . 2008-03-07 14:02 29,696 -----c--- C:\WINDOWS\system32\dllcache\mimefilt.dll

2008-07-29 11:06 . 2008-07-29 11:06 <DIR> d-------- C:\Arquivos de programas\Microsoft Silverlight

2008-07-29 10:26 . 2008-08-10 08:22 <DIR> d--h----- C:\$AVG8.VAULT$

2008-07-27 21:40 . 2008-08-03 16:55 <DIR> d-------- C:\Arquivos de programas\EasyPHP1-8

2008-07-26 14:25 . 2004-06-06 20:17 53,248 --a------ C:\WINDOWS\system32\uninstpw.exe

2008-07-26 14:25 . 2005-05-07 14:15 24,576 --a------ C:\WINDOWS\system32\custsave.exe

2008-07-25 22:28 . 2008-07-25 22:28 <DIR> d-------- C:\Documents and Settings\Nildo\Dados de aplicativos\CyberLink

2008-07-25 07:48 . 2008-07-25 07:54 <DIR> d-------- C:\Arquivos de programas\eMule

2008-07-23 22:45 . 2008-07-23 22:45 <DIR> d--h----- C:\WINDOWS\system32\Scpad

2008-07-23 07:09 . 2008-08-09 13:50 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg

2008-07-23 07:09 . 2008-07-26 07:17 97,928 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys

2008-07-23 07:09 . 2008-07-23 07:09 76,040 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys

2008-07-23 07:09 . 2008-07-23 07:09 12,936 --a------ C:\WINDOWS\system32\drivers\avgrkx86.sys

2008-07-23 07:09 . 2008-07-23 07:09 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll

2008-07-23 06:58 . 2008-07-23 07:08 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Avg8

2008-07-17 20:15 . 2008-07-17 20:15 <DIR> d-------- C:\Documents and Settings\Nildo\Dados de aplicativos\GanymedeNet

2008-07-17 20:15 . 2008-07-17 20:15 4 --a------ C:\WINDOWS\system32\proc-220146841.bin

2008-07-16 23:34 . 2008-07-16 23:35 <DIR> d-------- C:\WINDOWS\Downloaded Installations

2008-07-15 14:32 . 2008-08-03 11:20 69 --a------ C:\WINDOWS\NeroDigital.ini

2008-07-14 23:24 . 2003-12-12 16:06 1,693,696 --a------ C:\WINDOWS\system32\ltclr13n.dll

2008-07-14 23:24 . 2003-11-04 15:11 155,648 --a------ C:\WINDOWS\system32\lftif13n.dll

2008-07-14 23:24 . 2003-11-04 15:10 98,304 --a------ C:\WINDOWS\system32\lffax13n.dll

2008-07-14 23:23 . 2004-05-14 16:53 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll

2008-07-14 23:23 . 2004-05-14 16:53 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll

2008-07-14 23:23 . 2004-05-14 16:53 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll

2008-07-14 23:23 . 2004-05-14 16:53 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll

2008-07-14 23:23 . 2004-01-12 02:09 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll

2008-07-14 23:23 . 2004-05-14 16:53 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll

2008-07-14 23:23 . 2003-11-04 15:10 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll

2008-07-14 23:23 . 2004-05-14 16:53 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-08-10 13:19 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin

2008-08-10 13:16 --------- d-----w C:\Documents and Settings\Nildo\Dados de aplicativos\Orbit

2008-08-10 12:08 --------- d-----w C:\Arquivos de programas\Manutenção

2008-07-27 01:41 --------- d--h--w C:\Arquivos de programas\InstallShield Installation Information

2008-07-23 09:54 --------- d-----w C:\Arquivos de programas\Orbitdownloader

2008-07-22 01:05 --------- d-----w C:\Arquivos de programas\GbPlugin

2008-07-17 19:45 --------- d-----w C:\Arquivos de programas\Lexmark X1100 Series

2008-07-09 19:42 --------- d-----w C:\Arquivos de programas\PrimoPDF

2008-07-09 19:39 --------- d-----w C:\Arquivos de programas\activePDF

2008-07-09 11:35 --------- d-----w C:\Arquivos de programas\AIDA32

2008-07-08 09:53 --------- d-----w C:\Arquivos de programas\lg_fwupdate

2008-07-07 09:18 --------- d--h--w C:\Arquivos de programas\Scpad

2008-07-06 22:04 --------- d-----w C:\Arquivos de programas\MSXML 4.0

2008-07-06 12:49 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Ahead

2008-07-06 12:48 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Ahead

2008-07-06 12:45 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Nero

2008-07-06 12:38 --------- d-----w C:\Arquivos de programas\Nero

2008-07-06 12:28 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\CyberLink

2008-07-06 12:12 --------- d-----w C:\Arquivos de programas\CyberLink

2008-07-06 12:11 --------- d-----w C:\Arquivos de programas\Arquivos comuns\InstallShield

2008-07-05 11:58 --------- d-----w C:\Arquivos de programas\AVG

2008-07-05 11:21 --------- d-----w C:\Arquivos de programas\AllKeys

2008-07-05 10:11 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Adobe

2008-07-05 00:26 --------- d-----w C:\Arquivos de programas\Microsoft.NET

2008-07-04 23:47 --------- d-----w C:\Documents and Settings\Nildo\Dados de aplicativos\Microsoft Web Folders

2008-07-04 23:46 --------- d-----w C:\Arquivos de programas\microsoft frontpage

2008-07-04 22:44 --------- d-----w C:\Arquivos de programas\Windows Live

2008-07-04 22:43 --------- dcsh--w C:\Arquivos de programas\Arquivos comuns\WindowsLiveInstaller

2008-07-04 22:30 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\WLInstaller

2008-07-03 23:45 --------- d-----w C:\Arquivos de programas\VIAudioi

2008-07-03 23:44 --------- d-----w C:\Arquivos de programas\VIA

2008-07-03 18:41 --------- d-----w C:\Arquivos de programas\Alwil Software

2008-07-03 18:09 --------- d-----w C:\Arquivos de programas\Serviços on-line

2008-07-03 18:08 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Serviços

2008-06-25 09:36 43,520 ----a-w C:\WINDOWS\system32\drivers\fetnd5bv.sys

2008-06-20 17:48 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll

2008-06-20 11:51 361,600 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys

2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys

2008-06-20 11:08 225,856 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys

2008-06-14 17:34 272,384 ------w C:\WINDOWS\system32\drivers\bthport.sys

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

REGEDIT4

*Nota* entradas vazias & legítimas por defeito não são mostradas.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 19:20 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Lexmark X1100 Series"="C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 11:12 57344]

"AVG8_TRAY"="C:\ARQUIV~1\AVG\AVG8\avgtray.exe" [2008-07-26 07:17 1235736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"GrpConv"="grpconv -o" [X]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-13 19:20 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]

"{A3717295-941D-416F-9384-ED1736729F1C}"= "C:\Arquivos de programas\Scpad\scpLIB.dll" [2007-12-12 11:32 201984]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{E37CB5F0-51F5-4395-A808-5FA49E399007}"= "C:\ARQUIV~1\GbPlugin\gbiehabn.dll" [2008-05-16 15:01 369064]

"{E37CB5F0-51F5-4395-A808-5FA49E399F83}"= "C:\Arquivos de programas\GbPlugin\gbieh.dll" [2008-04-15 09:37 378696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

"CompIBBrd"= {A3717295-941D-416F-9384-ED1736729F1C} - C:\Arquivos de programas\Scpad\scpLIB.dll [2007-12-12 11:32 201984]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginAbn]

2008-05-16 15:01 369064 C:\ARQUIV~1\GbPlugin\gbiehabn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginBb]

2008-04-15 09:37 378696 C:\Arquivos de programas\GbPlugin\gbieh.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

--a------ 2008-01-11 22:16 39792 C:\Arquivos de programas\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AudioDeck]

-ra------ 2006-03-20 15:26 516096 C:\Arquivos de programas\VIAudioi\SBADeck\ADeck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]

--a------ 2007-05-15 15:55 1057328 C:\Arquivos de programas\Nero\Nero 7\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]

--a------ 2006-12-05 22:55 54832 C:\Arquivos de programas\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

--a------ 2007-03-01 15:57 153136 C:\Arquivos de programas\Arquivos comuns\Ahead\lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]

--------- 2006-11-23 15:10 56928 C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc]

--a------ 2007-05-15 15:55 1628208 C:\Arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"=

"C:\\Arquivos de programas\\Orbitdownloader\\orbitdm.exe"=

"C:\\Arquivos de programas\\Orbitdownloader\\orbitnet.exe"=

"C:\\WINDOWS\\system32\\dpvsetup.exe"=

"C:\\Arquivos de programas\\AVG\\AVG8\\avgemc.exe"=

"C:\\Arquivos de programas\\AVG\\AVG8\\avgupd.exe"=

"C:\\Arquivos de programas\\AVG\\AVG8\\avgnsx.exe"=

"C:\\WINDOWS\\system32\\LEXPPS.EXE"=

"C:\\Arquivos de programas\\AllKeys\\AllKeys.exe"=

"C:\\Arquivos de programas\\Megacubo\\megacubo.exe"=

"C:\\Arquivos de programas\\Megacubo\\megasrv.exe"=

R0 AvgRkx86;avgrkx86.sys;C:\WINDOWS\system32\Drivers\avgrkx86.sys [2008-07-23 07:09]

S1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-26 07:17]

S2 avg8emc;AVG8 E-mail Scanner;C:\ARQUIV~1\AVG\AVG8\avgemc.exe [2008-07-26 07:17]

S2 avg8wd;AVG8 WatchDog;C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe [2008-07-26 07:17]

S2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-23 07:09]

S3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2008-06-25 06:36]

*Newly Created Service* - CATCHME

.

Conteúdo da pasta 'Tarefas Agendadas'

2008-08-09 C:\WINDOWS\Tasks\SmartDefrag.job

- C:\Arquivos de programas\Manuten []

2008-08-09 C:\WINDOWS\Tasks\SmartDefrag.job

- C:\Arquivos de programas\Manuten []

.

- - - - ORFAOS REMOVIDOS - - - -

HKLM-Run-SmartDefrag - C:\Arquivos de programas\Manutenção\IObit SmartDefrag\IObit SmartDefrag.exe

.

------- Ccan Suplementar -------

.

R0 -: HKCU-Main,Start Page = hxxp://www.ig.com.br/

R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore

O8 -: &Download by Orbit - C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/201

O8 -: &Grab video by Orbit - C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/204

O8 -: Do&wnload selected by Orbit - C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/203

O8 -: Down&load all by Orbit - C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/202

O8 -: E&xportar para o Microsoft Excel - C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O16 -: {E37CB5F0-51F5-4395-A808-5FA49E399007} - hxxps://wwws.realsecureweb.com.br/mpr/plugin/Cab/GbPluginABN.cab

C:\WINDOWS\Downloaded Program Files\GbPluginABN.inf

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-08-10 10:35:05

Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros ocultos ...

C:\DOCUME~1\Nildo\CONFIG~1\Temp\RGI1.tmp

Varredura completada com sucesso

Ficheiros ocultos: 1

**************************************************************************

.

Tempo para conclusão: 2008-08-10 10:37:12

ComboFix-quarantined-files.txt 2008-08-10 13:36:57

Pre-Run: 8 pasta(s) 30,520,213,504 bytes disponíveis

Post-Run: 12 pasta(s) 30,813,212,672 bytes disponíveis

199 --- E O F --- 2008-07-10 02:03:45

Logfile of HijackThis v1.99.1

Scan saved at 10:27, on 2008-08-10

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\ARQUIV~1\GbPlugin\GbpSv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmgr.exe

C:\ARQUIV~1\AVG\AVG8\avgtray.exe

C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmon.exe

C:\WINDOWS\msmsgs.exe

C:\WINDOWS\system32\ctfmon.exe

C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

C:\WINDOWS\System32\svchost.exe

C:\ARQUIV~1\AVG\AVG8\avgam.exe

C:\ARQUIV~1\AVG\AVG8\avgrsx.exe

C:\ARQUIV~1\AVG\AVG8\avgnsx.exe

C:\ARQUIV~1\AVG\AVG8\avgemc.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\DOCUME~1\Nildo\CONFIG~1\Temp\Rar$EX00.281\HijackThis.exe