[Resolvido!] disapareceu PrdMgr.exe

fc_consoni · Outubro 6, 2008

Boa tarde!

Provavelmente deve ser algum tipo de virus, alem de não entrar na rede, tambem não acessa a internet, conforme uma dica aqui do forum que quando não se sabe direito o que cada coisa faz é melhor postar para quem sabe diagnosticar então seque o log do HijackThis abaixo:

________________________

Logfile of HijackThis v1.99.1

Scan saved at 08:42:30, on 6/10/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\Arquivos de programas\Java\jre1.5.0_06\bin\jusched.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\Arquivos de programas\Winamp\winampa.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\drivers\FmMgr.exe

C:\WINDOWS\pchealth\helpctr\binaries\svchost.exe

C:\Arquivos de programas\OpenOffice.org 2.0\program\soffice.exe

C:\Arquivos de programas\OpenOffice.org 2.0\program\soffice.BIN

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashSimpl.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\RealVNC\VNC4\WinVNC4.exe

C:\Documents and Settings\Cliente\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com.br/0SEPTBR/SAOS01?FORM=TOOLBR

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com.br/0SEPTBR/SAOS01?FORM=TOOLBR

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com.br/0SEPTBR/SAOS01?FORM=TOOLBR

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch

R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Arquivos de programas\Winamp Toolbar\winamptb.dll

F2 - REG:system.ini: Shell=Explorer.exe %WINDIR%\system32\drivers\PrdMgr.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)

O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Arquivos de programas\Winamp Toolbar\winamptb.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Arquivos de programas\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Arquivos de programas\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Arquivos de programas\Winamp Toolbar\winamptb.dll

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Arquivos de programas\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [WinampAgent] "C:\Arquivos de programas\Winamp\winampa.exe"

O4 - HKLM\..\Run: [svchost.exe] C:\WINDOWS\pchealth\helpctr\binaries\svchost.exe

O4 - HKLM\..\Run: [FmMgr.exe] C:\WINDOWS\system32\drivers\FmMgr.exe

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - Startup: OpenOffice.org 2.0.lnk = C:\Arquivos de programas\OpenOffice.org 2.0\program\quickstart.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dados de aplicativos\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html

O8 - Extra context menu item: &Windows Live Search - res://C:\Arquivos de programas\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: Abrir em uma nova guia do plano de fundo - res://C:\Arquivos de programas\Windows Live Toolbar\Components\pt-br\msntabres.dll.mui/229?03b447226ba547fb9430535b3189e8f2

O8 - Extra context menu item: Abrir em uma nova guia do primeiro plano - res://C:\Arquivos de programas\Windows Live Toolbar\Components\pt-br\msntabres.dll.mui/230?03b447226ba547fb9430535b3189e8f2

O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O17 - HKLM\System\CCS\Services\Tcpip\..\{E270385E-CBC0-44F5-85B4-50823CFE41AA}: NameServer = 201.10.120.2,201.10.128.3

O17 - HKLM\System\CCS\Services\Tcpip\..\{FDF2F365-C19E-4632-A382-88115FBC5F66}: NameServer = 201.10.120.2,201.10.128.3

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Arquivos de programas\RealVNC\VNC4\WinVNC4.exe" -service (file missing)

_________________________________________________________

antecipadamente já agradeço a todos!

PedroN · Outubro 6, 2008

Faça o download do SDFix

Reinicie seu computador, e aperte a tecla F8 (F5 em alguns casos) intermitentemente durante a inicialização, até aparecer um menu onde você deverá escolher a opção Modo Seguro.

1. Entre na pasta SDFix que foi instalada no seu computador e dê um duplo clique no arquivo RunThis.bat

2. Tecle Y para que a ferramenta inicie o processo de remoção

3. Quando tudo terminar, você verá um aviso dizendo para apertar qualquer tecla para continuar. Ao pressionar qualquer tecla, o computador será reiniciado automaticamente

4. Após reiniciar, a ferramenta ainda será executada novamente e irá terminar o seu trabalho e a palavra Finished irá aparecer. Pressione qualquer tecla.

5. Uma janela com o relatório do SDFix irá aparecer.

6. Copie e cole este relatório na sua resposta (se for postar na area de remoção de malware). Caso você tenha fechado a janela, uma cópia do relatório estará na pasta SDFix com o nome Report.txt

fc_consoni · Outubro 7, 2008

Relatorio SDfix

SDFix: Version 1.232

Run by Administrador on ter 07/10/2008 at 09:13

Microsoft Windows XP [versÆo 5.1.2600]

Running From: C:\SDFix

Checking Services :

C:\WINDOWS\system32\Microsoft\backup.ftp Found

C:\WINDOWS\system32\Microsoft\backup.tftp Found

Checking files:

Genuine:

C:\WINDOWS\system32\Microsoft\backup.ftp

C:\WINDOWS\system32\Microsoft\backup.tftp

Dummy:

C:\WINDOWS\system32\ftp.exe

C:\WINDOWS\system32\tftp.exe

C:\WINDOWS\system32\dllcache\ftp.exe

C:\WINDOWS\system32\dllcache\tftp.exe

Files copied to SDFix\Backups

Restoring files if backups are found

Final Check:

Genuine:

C:\WINDOWS\system32\Microsoft\backup.ftp

C:\WINDOWS\system32\Microsoft\backup.tftp

C:\WINDOWS\system32\ftp.exe

C:\WINDOWS\system32\tftp.exe

C:\WINDOWS\system32\dllcache\ftp.exe

C:\WINDOWS\system32\dllcache\tftp.exe

Restoring Default Security Values

Restoring Default Hosts File

Rebooting

Checking Files :

Trojan Files Found:

C:\WINDOWS\Photo_13301.zip - Deleted

C:\WINDOWS\pchealth\helpctr\binaries\svchost.exe - Deleted

C:\WINDOWS\system32\Microsoft\backup.ftp - Deleted

C:\WINDOWS\system32\Microsoft\backup.tftp - Deleted

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-10-07 09:26:57

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden services: 0

hidden files: 0

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"

"C:\\Arquivos de programas\\PAC_MEC\\pac_main.exe"="C:\\Arquivos de programas\\PAC_MEC\\pac_main.exe:*:Disabled:pac_main"

"C:\\Arquivos de programas\\MSN Messenger\\msnmsgr.exe"="C:\\Arquivos de programas\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"

"C:\\Arquivos de programas\\MSN Messenger\\livecall.exe"="C:\\Arquivos de programas\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\\Arquivos de programas\\MSN Messenger\\msnmsgr.exe"="C:\\Arquivos de programas\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"

"C:\\Arquivos de programas\\MSN Messenger\\livecall.exe"="C:\\Arquivos de programas\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Remaining Files :

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Wed 1 Oct 2008 76,288 ..SHR --- "C:\WINDOWS\system32\drivers\FmMgr.exe"

Wed 3 Oct 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\2ea39eb67545fd2ec9095bec39ab77c7\BITF.tmp"

Mon 17 Dec 2007 23,552 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\liz\Liz\~WRL0003.tmp"

Mon 17 Dec 2007 23,552 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Liz\~WRL0003.tmp"

Wed 15 Mar 2006 95,232 A..H. --- "C:\Documents and Settings\Cliente\Meus documentos\Secretaria\micro_01\Mapas das salas\~WRL1239.tmp"

Fri 19 Oct 2007 122,368 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\elias biz\pre vespertino\~WRL1699.tmp"

Fri 31 Aug 2007 32,768 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\elias biz\pre vespertino\~WRL2165.tmp"

Fri 31 Aug 2007 76,288 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\elias biz\pre vespertino\~WRL3338.tmp"

Thu 20 Sep 2007 19,456 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Escola Rio Caet‚\2¦ serie\~WRL2457.tmp"

Thu 19 Apr 2007 25,600 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Escola - Palmeira\4¦ serie\~WRL1321.tmp"

Wed 22 Aug 2007 33,280 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\F bio\ED_FISICA\~WRL0003.tmp"

Wed 22 Aug 2007 89,088 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\F bio\ED_FISICA\~WRL0208.tmp"

Wed 22 Aug 2007 34,304 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\F bio\ED_FISICA\~WRL0280.tmp"

Wed 22 Aug 2007 89,088 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\F bio\ED_FISICA\~WRL1490.tmp"

Wed 22 Aug 2007 53,248 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\F bio\ED_FISICA\~WRL1501.tmp"

Wed 22 Aug 2007 89,088 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\F bio\ED_FISICA\~WRL3695.tmp"

Thu 9 Mar 2006 139,776 ...HR --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Neglie\5_serie\~WRL0669.tmp"

Thu 17 Aug 2006 588,800 ...HR --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Neglie\present_continuous\~WRL2051.tmp"

Mon 7 May 2007 40,448 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\temporaria\Patr¡cia\~WRL2025.tmp"

Tue 9 Sep 2008 118,272 A..H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\N¶O DELETAR\mapa de notas 1 a 4 s‚rie\ARTES, ED_FISICA, ITALIANO\~WRL0738.tmp"

Tue 8 Apr 2008 114,688 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\liz\Liz\Liz\MAPA_GN_2008\~WRL3300.tmp"

Thu 31 Mar 2005 57,344 A..H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\liz\Liz\Liz\micro_01\~WRL0001.tmp"

Thu 31 Mar 2005 56,832 A..H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\liz\Liz\Liz\micro_01\~WRL0991.tmp"

Wed 5 Oct 2005 22,016 A..H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\liz\Liz\Liz\micro_01\~WRL1548.tmp"

Thu 31 Mar 2005 57,344 A..H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Alex\Liz\Liz\~WRL0001.tmp"

Thu 31 Mar 2005 56,832 A..H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Alex\Liz\Liz\~WRL0991.tmp"

Wed 5 Oct 2005 22,016 A..H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Alex\Liz\Liz\~WRL1548.tmp"

Wed 9 May 2007 271,360 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Escola Rio Caet‚\1¦ serie\2007\~WRL2312.tmp"

Thu 20 Sep 2007 19,456 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Escola - Palmeira\2¦ serie\2007\~WRL2661.tmp"

Tue 8 Apr 2008 114,688 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Liz\Liz\MAPA_GN_2008\~WRL3300.tmp"

Thu 31 Mar 2005 57,344 A..H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Liz\Liz\micro_01\~WRL0001.tmp"

Thu 31 Mar 2005 56,832 A..H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Liz\Liz\micro_01\~WRL0991.tmp"

Wed 5 Oct 2005 22,016 A..H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Liz\Liz\micro_01\~WRL1548.tmp"

Fri 1 Sep 2006 19,456 ...HR --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\temporaria\Lydio\601\~WRL3100.tmp"

Thu 20 Sep 2007 28,672 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\liz\Liz\Liz\2007\mapa_geral_notas\~WRL0714.tmp"

Thu 20 Sep 2007 24,576 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\liz\Liz\Liz\2007\mapa_geral_notas\~WRL1010.tmp"

Thu 20 Sep 2007 29,696 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\liz\Liz\Liz\2007\mapa_geral_notas\~WRL1537.tmp"

Thu 20 Sep 2007 25,088 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\liz\Liz\Liz\2007\mapa_geral_notas\~WRL2622.tmp"

Thu 20 Sep 2007 28,672 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\liz\Liz\Liz\2007\mapa_geral_notas\~WRL2956.tmp"

Thu 20 Sep 2007 28,672 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Liz\Liz\2007\mapa_geral_notas\~WRL0714.tmp"

Thu 20 Sep 2007 24,576 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Liz\Liz\2007\mapa_geral_notas\~WRL1010.tmp"

Thu 20 Sep 2007 29,696 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Liz\Liz\2007\mapa_geral_notas\~WRL1537.tmp"

Thu 20 Sep 2007 25,088 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Liz\Liz\2007\mapa_geral_notas\~WRL2622.tmp"

Thu 20 Sep 2007 28,672 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Liz\Liz\2007\mapa_geral_notas\~WRL2956.tmp"

Tue 9 Sep 2008 118,272 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Liz\Liz\MAPA_GN_2008\ARTES, ED_FISICA, ITALIANO\~WRL0738.tmp"

Thu 30 Aug 2007 154,624 ...H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\lydio\Inglˆs\6¦ serie\601\~WRL0556.tmp"

Thu 17 Aug 2006 588,800 ...HR --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\temporaria\Lydio\601\present_continuous\~WRL2051.tmp"

Tue 2 May 2006 51,200 A..H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\liz\Liz\Liz\micro_01\2006\mapas_ed_fis_arte\~WRL1363.tmp"

Mon 1 Aug 2005 108,544 ...HR --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Alex\2005\ativ_escolas_int\Rosalino\cruzadinha_do_h_separar_silabas\~WRL0053.tmp"

Mon 1 Aug 2005 79,872 ...HR --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Alex\2005\ativ_escolas_int\Rosalino\cruzadinha_do_h_separar_silabas\~WRL1316.tmp"

Mon 1 Aug 2005 89,088 ...HR --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Alex\2005\ativ_escolas_int\Rosalino\cruzadinha_do_h_separar_silabas\~WRL3788.tmp"

Mon 1 Aug 2005 207,360 ...HR --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Alex\2005\ativ_escolas_int\Rosalino\cruzadinha_do_h_separar_silabas\~WRL3926.tmp"

Thu 9 Mar 2006 139,776 ...HR --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Alex\2006\2006\Neglie\5_serie\~WRL0669.tmp"

Thu 17 Aug 2006 588,800 ...HR --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Alex\2006\2006\Neglie\present_continuous\~WRL2051.tmp"

Tue 2 May 2006 51,200 A..H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Alex\Liz\Liz\2006\mapas_ed_fis_arte\~WRL1363.tmp"

Tue 2 May 2006 51,200 A..H. --- "C:\Documents and Settings\Cliente\Desktop\fabio\Meus documentos\Liz\Liz\micro_01\2006\mapas_ed_fis_arte\~WRL1363.tmp"

Finished!

PedroN · Outubro 7, 2008

- Poste um novo log do hijackthis

lyrizito · Outubro 8, 2008

^^ to com o mesmo problema cara... varios micros tão vindo pra ca com esse problema cara...

alguns resolvi reinstalando o windows e passando o Smith Fraud Fix... mas esse aki agora nao resolveu.. continua o erro

quem conseguir uma solução pf avisa aew

abração

PedroN · Outubro 8, 2008

lyrizito, abra um tópico nessa área, e nele poste um log do hijackthis de acordo com esse tópico.

http://forum.imasters.com.br/index.php?showtopic=165906

fc_consoni · Outubro 9, 2008

- Poste um novo log do hijackthis

Bom dia Sr. Perfect

Segue o novo log

_____

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 08:12:36, on 9/10/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Safe mode

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.exe

C:\Hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - Default URLSearchHook is missing