WINTEMS, SROSA e HLDRRR

Exceivier · Dezembro 3, 2008

Bom dia pessoal, sou novo aqui no fórum e vi algumas mensagens de membros que estavam com problemas parecidos com o meu.

Só que me pareceu que cada problema possui uma característica individualizada.

Baixei o EliBaglA e ele me informou o seguinte:

Wed Dec 03 02:00:14 2008

----------------------------------------------

Lista de Acciones (por Acción Directa):

C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.

C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle Acceso Denegado.

C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle Acceso Denegado.

Wed Dec 03 02:01:06 2008

----------------------------------------------

Lista de Acciones (por Exploración):

Explorando Unidad C:\

Nº Total de Directorios: 5476

Nº Total de Ficheros: 55850

Nº de Ficheros Analizados: 6288

Nº de Ficheros Infectados: 0

Nº de Ficheros Limpiados: 0

O que devo fazer? Ao inicar o meu windows, aparece uma tela azul e ele reinicia.

Desde já agradeço pela atenção de todos.

DigRam · Dezembro 3, 2008

Bom Dia! Exceivier

<!> Remova o EliBagla de seu computador! Posteriormente,se houver necessidade,será baixado novamente.

-------------------------

<@> Baixe: < FindyKill > ( ...par Chiquitine29 )

<@> Salve-a em Arquivos de Programas!

<@> Feche programas que estejam abertos.

<@> Desabilite a proteção residente de antivírus e antispywares.

<@> Instale a ferramenta,e aceite todas as condições pedidas.

<@> Terminando;execute a ferramenta com um duplo-clique,em: C:\Arquivos de Programas\FindyKill\FindyKill.bat <--

<@> No prompt,aperte o C. --> Enter. <-- Opção de linguas!

<@> À seguir,aperte o 2. ( "Eliminar los ficheros infectados" )

<@> Aperte Enter --> O computador vai reiniciar,por duas vezes! --> Aguarde!

<@> Terminando,clique em uma área vazia do prompt! --> Aperte Enter.

<@> Abrir-se-à o Bloco de Notas,com o relatório: C:\FindyKill.txt <-- Rapport!

-------------------------

<!> Caso possa,instale o HijackThis e poste o relatório.

-------------------------

<@> Faça o download do HijackThis.

<@> Baixe-o para Arquivos de Programas.

<@> Mas,não execute-o ainda!

<@> Para que o Log do HijackThis saia completo,vá em Iniciar --> Executar.

<@> Digite: msconfig --> Clique Ok.

<@> Na janela que abrir,marque: Inicialização normal - Carregar todos os drivers de dispositivo e serviços

<@> Clique em Aplicar --> Ok.

<@> Reinicie o computador!

<@> Abra o HijackThis,e clique em: Do a system scan and save a logfile

<@> Abrir-se-á um Bloco de Notas!

<@> Selecione e copie o seu conteúdo,para este Tópico.

Abraços!

Exceivier · Dezembro 3, 2008

Já comecei a senti melhoras na saúde do meu computador.

Muito obrigado DigRam pela atenção!

Abraço.

----------------- FindyKill V4.706 ------------------

* User : 12-11-2008 - THIAGO

* executed from : C:\Arquivos de programas\FindyKill

* Update on 27/11/08 par Chiquitine29

* Start at 4:23:16 the qua 03/12/2008

* Windows XP - Internet Explorer 7.0.5730.13

((((((((((((((( *** deleting *** ))))))))))))))))))

--------------- [ Active Processes ] ----------------

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\Arquivos de programas\AVG\AVG8\avgrsx.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\logonui.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\ARQUIV~1\GbPlugin\GbpSv.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\userinit.exe

C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

C:\WINDOWS\system32\cisvc.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\tcpsvcs.exe

C:\WINDOWS\System32\snmp.exe

--------------- [ Infected files / folders ] ----------------

»»»» Supression files in C:

»»»» Supression files in C:\WINDOWS

»»»» Supression files in C:\WINDOWS\Prefetch

»»»» Supression files in C:\WINDOWS\system32

»»»» Supression files in C:\WINDOWS\system32\drivers

Deleted ! - C:\WINDOWS\system32\drivers\down\11354921.exe

Deleted ! - C:\WINDOWS\system32\drivers\down\11357265.exe

Deleted ! - C:\WINDOWS\system32\drivers\down\11360703.exe

Deleted ! - C:\WINDOWS\system32\drivers\down\11361093.exe

Deleted ! - C:\WINDOWS\system32\drivers\down\11362328.exe

Deleted ! - C:\WINDOWS\system32\drivers\down\11364281.exe

Deleted ! - C:\WINDOWS\system32\drivers\down\11365968.exe

Deleted ! - C:\WINDOWS\system32\drivers\down\11370484.exe

Deleted ! - C:\WINDOWS\system32\drivers\down\113890.exe

Deleted ! - C:\WINDOWS\system32\drivers\down\113938906.exe

Deleted ! - C:\WINDOWS\system32\drivers\down\113940093.exe

Deleted ! - C:\WINDOWS\system32\drivers\down\11394203.exe

Deleted ! - C:\WINDOWS\system32\drivers\down\113949500.exe

Deleted ! - C:\WINDOWS\system32\drivers\down\113953062.exe

Deleted ! - C:\WINDOWS\system32\drivers\down\113957828.exe

Deleted ! - C:\WINDOWS\system32\drivers\down\114031.exe

Deleted ! - C:\WINDOWS\system32\drivers\down\114059515.exe

Deleted ! - C:\WINDOWS\system32\drivers\down\114062359.exe

Deleted ! - C:\WINDOWS\system32\drivers\down\114089078.exe

Deleted ! - C:\WINDOWS\system32\drivers\down\114090562.exe

Deleted ! - C:\WINDOWS\system32\drivers\down\11409421.exe

Deleted ! - C:\WINDOWS\system32\drivers\down\114103578.exe

Deleted ! - C:\WINDOWS\system32\drivers\down\114108109.exe

Deleted ! - C:\WINDOWS\system32\drivers\down\114109781.exe

----------------------------------------------------------------------------

<!> Vai aqui,o Link ao relatório do FindyKill: < http://www.badongo.com/file/12353097 >

Abraços!

Exceivier · Dezembro 3, 2008

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:32:03, on 3/12/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\ARQUIV~1\GbPlugin\GbpSv.exe

C:\WINDOWS\system32\spoolsv.exe

C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

C:\WINDOWS\system32\cisvc.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\tcpsvcs.exe

C:\WINDOWS\System32\snmp.exe

C:\ARQUIV~1\AVG\AVG8\avgrsx.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\ARQUIV~1\AVG\AVG8\avgtray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Adobe\Acrobat 6.0\Distillr\acrotray.exe

C:\Documents and Settings\12-11-2008\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Shareaza Web Download Hook - {0EEDB912-C5FA-486F-8334-57288578C627} - C:\Arquivos de programas\Crux P2P\Plugins\RazaWebHook.dll (file missing)

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG8\avgssie.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\ARQUIV~1\AVG\AVG8\AVGTOO~1.DLL

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: G-Buster Browser Defense ABN AMRO - {C41A1C0E-EA6C-11D4-B1B8-444553540007} - C:\ARQUIV~1\GbPlugin\gbiehabn.dll

O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Arquivos de programas\Search Settings\kb125\SearchSettings.dll (file missing)

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\ARQUIV~1\AVG\AVG8\AVGTOO~1.DLL

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [NeroRebootSetup] "C:\Documents and Settings\Xavier\Configurações locais\Temp\nro.tmp\SetupX.exe" SC CONFIGPATH="C:\DOCUME~1\Xavier\CONFIG~1\Temp\NERO1002626\" SC SOURCEPATH="C:\DOCUME~1\Xavier\CONFIG~1\Temp\NERO1002626\"

O4 - HKLM\..\Run: [searchSettings] C:\Arquivos de programas\Search Settings\SearchSettings.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NvGraphicsInterface] C:\runmgr.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll

O4 - HKLM\..\Run: [iTunesHelper] "C:\Arquivos de programas\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARQUIV~1\AVG\AVG8\avgtray.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Vidalia] "C:\Arquivos de programas\Vidalia Bundle\Vidalia\vidalia.exe"

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Acrobat Assistant.lnk = C:\Arquivos de programas\Adobe\Acrobat 6.0\Distillr\acrotray.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Arquivos de programas\Arquivos comuns\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Iolo Macro Magic.lnk = C:\Arquivos de programas\Iolo\Macro Magic\Macros.exe

O4 - Global Startup: Last.fm Helper.lnk = C:\Arquivos de programas\Last.fm\LastFMHelper.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office10\OSA.EXE

O9 - Extra button: iOpus iMacros - {0483894E-2422-45E0-8384-021AFF1AF3CD} - C:\Arquivos de programas\iMacros\imacros.dll (file missing)

O9 - Extra 'Tools' menuitem: iMacros Web Automation - {0483894E-2422-45E0-8384-021AFF1AF3CD} - C:\Arquivos de programas\iMacros\imacros.dll (file missing)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Arquivos de programas\AVG\AVG8\avgpp.dll

O20 - AppInit_DLLs: avgrsstx.dll

O20 - Winlogon Notify: GbPluginAbn - C:\ARQUIV~1\GbPlugin\gbiehabn.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Gbp Service (GbpSv) - Unknown owner - C:\ARQUIV~1\GbPlugin\GbpSv.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--

End of file - 7417 bytes

DigRam · Dezembro 4, 2008

Bom Dia! Exceivier

<@> Baixe: < ComboFix.exe >

<@> Salve-o no Desktop!

<@> Desabilite as proteções residente de: antivírus,antispywares e firewall. ( Menos o do Windows! )

<@> Feche todas as janelas e execute a ferramenta!

<@> Na solicitação: "Negação de garantia de software" --> Clique em Sim!

<@> Não possuindo o "Console de Recuperação",aceite optar pela instalação do mesmo!

<!> Caso aconteça a notificação de: Aplicativo Win32 inválido,delete a ferramenta e faça,novamente,o download.
<!> Salve-a no desktop,renomeada como: Kombo.exe

<!> Ps: Nomeie durante o salvamento,e não após salvá-la!

<!> Ps: Surgindo alguma mensagem de erro,rode o ComboFix.exe em Modo de Segurança.

<!> Ps: Para completar as remoções,talvez haja necessidade da ferramenta reiniciar o computador. <-- Aguarde!

<!> Ps: Evite executar,voluntariamente,esta ferramenta!Siga,àcima,todas as recomendações propostas.

<@> Abrir-se-á a janela Auto Scan. --> Aguarde!

<@> Àfim de completar as remoções,o ComboFix poderá reiniciar o computador.

<@> Se houver necessidade,digite a opção para continuar! --> ( 1 ) --> Aperte Enter.

<@> Aguarde a conclusão!

<@> Durante o scan,evite manusear o mouse ou teclado! <-- Importante!

<@> Para parar ou sair do ComboFix,tecle "N" --> Enter.

----------------------

<@> Terminando,poste: C:\ComboFix.txt

Abraços!

Exceivier · Dezembro 8, 2008

Olá DigRam, surgiu alguns problemas no meu computador.

Primeiro que o ComboFix.exe roda, faz o scan e logo em seguida aparece a velha e já conhecida tela azul. Esta tela aparece em menos de 1 segundo, consegui ler algumas coisas como INVADED_KELNED... (ou algo parecido) e algo como DESPEJO DE MEMÓRIA FÍSICA.

Tentei rodar o programa no modo de segurança, tentei renomeá-lo, mas nada adiantou.

Outra coisa é que minha conexão na internet está com alguns problemas. Na sessão:

Conexão Local > Propriedades > Protocolo TCP/IP > Servidor DNS

apareceu os seguintes números:

85.255.115.50 — SERVIDOR DNS PREFERENCIAL

85.255.112.154 — SERVIDOR DNS ALTERNATIVO

Eu tentei desabilitar esta opção, ou deletar estes endereços de servidor, mas não obtive sucesso.

Estou enviando novamento os logs do FindyKill e do Hijackthis

----------------- FindyKill V4.706 ------------------

* User : Xavier - THIAGO

* executed from : C:\Arquivos de programas\FindyKill

* Update on 27/11/08 par Chiquitine29

* Start at 16:19:56 the seg 08/12/2008

* Windows XP - Internet Explorer 7.0.5730.13

((((((((((((((( *** deleting *** ))))))))))))))))))

--------------- [ Active Processes ] ----------------

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\logonui.exe

C:\ARQUIV~1\GbPlugin\GbpSv.exe

C:\WINDOWS\system32\spoolsv.exe

C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

C:\WINDOWS\system32\cisvc.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\tcpsvcs.exe

C:\WINDOWS\System32\snmp.exe

C:\ARQUIV~1\AVG\AVG8\avgrsx.exe

C:\WINDOWS\system32\userinit.exe

--------------- [ Infected files / folders ] ----------------

»»»» Supression files in C:

Deleted ! - C:\InfoSat.txt

»»»» Supression files in C:\WINDOWS

»»»» Supression files in C:\WINDOWS\Prefetch

Deleted ! - C:\WINDOWS\prefetch\EASYMACRORECORDERFULLYCRACKED-081A55DD.pf

Deleted ! - C:\WINDOWS\prefetch\KEYGEN.EXE-1339991F.pf

»»»» Supression files in C:\WINDOWS\system32

»»»» Supression files in C:\WINDOWS\system32\drivers

»»»» Supression files in C:\Documents and Settings\Xavier\Dados de aplicativos

Deleted ! - "C:\Documents and Settings\Xavier\Dados de aplicativos\m\list.oct"

Deleted ! - "C:\Documents and Settings\Xavier\Dados de aplicativos\m\data.oct"

Deleted ! - "C:\Documents and Settings\Xavier\Dados de aplicativos\m\srvlist.oct"

Deleted ! - C:\Documents and Settings\Xavier\Dados de aplicativos\m\shared\FlashPoint_Personal_2.39.czip

Deleted ! - C:\Documents and Settings\Xavier\Dados de aplicativos\m\shared\FlashPoint_Personal_2.39.zip

Deleted ! - "C:\Documents and Settings\Xavier\Dados de aplicativos\m\shared"

Deleted ! - "C:\Documents and Settings\Xavier\Dados de aplicativos\m"

»»»» Supression files in C:\DOCUME~1\Xavier\CONFIG~1\Temp

»»»» Supression files in C:\Documents and Settings\Xavier\Local Settings\Temporary Internet Files\Content.IE5

Deleted ! - C:\Documents and Settings\Xavier\Meus documentos\Minhas imagens\variadas\referˆncias\704294518_092d2ab64c.jpg

--------------- [ Registry / Infected keys ] ----------------

Deleted ! - HKEY_CURRENT_USER\Software\DateTime4

Deleted ! - HKEY_CURRENT_USER\Software\EWZ

Deleted ! - HKEY_CURRENT_USER\Software\XYZ

Deleted ! - HKEY_CURRENT_USER\Software\FirtR

Deleted ! - HKEY_CURRENT_USER\Software\FirstRRRun

Deleted ! - HKEY_USERS\S-1-5-21-527237240-261903793-725345543-1003\Software\Local AppWizard-Generated Applications\uiytuhjy

Deleted ! - HKEY_USERS\S-1-5-21-527237240-261903793-725345543-1003\Software\MuleAppData

--------------- [ States / Restarting of services ] ----------------

+- Services : [ Auto=2 / Request=3 / Disable=4 ]

Ndisuio - Type of startup = 3

Ip6Fw - Type of startup = 2

SharedAccess - Type of startup = 2

wuauserv - Type of startup = 2

wscsvc - Type of startup = 2

--------------- [ Cleaning removable drives ] ----------------

+- Informations :

C: - Unidade de disco fixo

+- deleting files :

Deleted ! - C:\autorun.inf

--------------- [ Registry / Mountpoint2 ] ----------------

-> Not found !

--------------- [ Searching Cracks / Keygen ] ----------------

C:\Documents and Settings\Xavier\Meus documentos\desktop\downloads\macro\Salling.Clicker.v3.5.0.860.WinALL.Incl.Keygen-ECLiPSE

C:\Documents and Settings\Xavier\Meus documentos\desktop\downloads\macro\Salling.Clicker.v3.5.0.860.WinALL.Incl.Keygen-ECLiPSE\ECLiPSE.NFO

C:\Documents and Settings\Xavier\Meus documentos\desktop\downloads\macro\Salling.Clicker.v3.5.0.860.WinALL.Incl.Keygen-ECLiPSE\FILE_ID.DiZ

C:\Documents and Settings\Xavier\Meus documentos\desktop\downloads\macro\Salling.Clicker.v3.5.0.860.WinALL.Incl.Keygen-ECLiPSE\motor.dll

C:\Documents and Settings\Xavier\Meus documentos\desktop\downloads\macro\Salling.Clicker.v3.5.0.860.WinALL.Incl.Keygen-ECLiPSE\Salling.Clicker.v3.5.0.860.exe

C:\Documents and Settings\Xavier\Meus documentos\desktop\downloads\programas\MegaMario_v1.5_w32_linux\data\gfx\bonus\cracked.PNG

C:\Documents and Settings\Xavier\Meus documentos\desktop\downloads\programas\MegaMario_v1.5_w32_linux\data\gfx\bonus\cracked2.PNG

C:\Documents and Settings\Xavier\Meus documentos\desktop\downloads\programas\MegaMario_v1.5_w32_linux\data\gfx\bonus\crackedlong.PNG

C:\Documents and Settings\Xavier\Meus documentos\desktop\downloads\programas\MegaMario_v1.5_w32_linux\data\gfx\bonus\crackstone.png

C:\Documents and Settings\Xavier\Meus documentos\desktop\downloads\programas\MegaMario_v1.5_w32_linux\data\gfx\bonus\crackstone2.png

C:\Documents and Settings\Xavier\Meus documentos\Minhas m£sicas\ladytron\Light & Magic\Ladytron_Cracked LCD_07_Light & Magic_Electronica_192kbps (2).mp3

C:\Documents and Settings\Xavier\Meus documentos\Minhas m£sicas\ladytron\Light & Magic\Ladytron_Cracked LCD_07_Light & Magic_Electronica_192kbps.mp3

---------------- ! End of report ! ------------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:31:17, on 8/12/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\ARQUIV~1\GbPlugin\GbpSv.exe

C:\WINDOWS\system32\spoolsv.exe

C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

C:\WINDOWS\system32\cisvc.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\tcpsvcs.exe

C:\WINDOWS\System32\snmp.exe

C:\ARQUIV~1\AVG\AVG8\avgrsx.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\cidaemon.exe

C:\Documents and Settings\Xavier\Meus documentos\desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://globominas.globo.com/Diversao/0,,8437,00.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8088