mulher 0 Denunciar post Postado Fevereiro 4, 2009 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 09:49:03, on 4/2/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\system32\WgaTray.exe C:\WINDOWS\system32\SnMgrSvc.exe C:\WINDOWS\system32\SnAgOS.exe C:\WINDOWS\system32\SnLiveUp.exe C:\WINDOWS\Explorer.exe C:\Arquivos de programas\Search Settings\SearchSettings.exe C:\Arquivos de programas\Windows Live\Proteção para a Família\fssui.exe C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ctfmon.exe C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe C:\WINDOWS\system32\wuauclt.exe C:\Arquivos de programas\Windows Live\Contacts\wlcomm.exe C:\Arquivos de programas\Internet Explorer\iexplore.exe C:\DOCUME~1\ADMINI~1\CONFIG~1\Temp\Diretório temporário 3 para HiJackThis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Arquivos de programas\Search Settings\kb126\SearchSettings.dll R3 - URLSearchHook: Barra de Ferramentas do Yahoo! - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Arquivos de programas\AskSBar\SrchAstt\2.bin\A2SRCHAS.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file) O2 - BHO: Windows Live OneCare Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Arquivos de programas\Windows Live\Proteção para a Família\fssbho.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Arquivos de programas\Search Settings\kb126\SearchSettings.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar1.dll O3 - Toolbar: Barra de Ferramentas do Yahoo! - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file) O4 - HKLM\..\Run: [searchSettings] C:\Arquivos de programas\Search Settings\SearchSettings.exe O4 - HKLM\..\Run: [fssui] "C:\Arquivos de programas\Windows Live\Proteção para a Família\fssui.exe" -autorun O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [avgnt] "C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background O4 - Startup: BrOffice.org 2.4.lnk = C:\Arquivos de programas\BrOffice.org 2.4\program\quickstart.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp O16 - DPF: {3C8B9651-4E3E-424D-B51C-54544ABF536B} (CAtmCap Object) - https://ww7.banrisul.com.br/bxz/data/securecontrol2k.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{22A5162A-CF53-40D2-BA7A-746FC3D40C24}: NameServer = 192.168.254.254 O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file) O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: SNMgrSvc - Open Communications Security S/A - C:\WINDOWS\system32\SnMgrSvc.exe -- End of file - 7075 bytes Esse log Malwarebytes' Anti-Malware 1.33 Versão do banco de dados: 1716 Windows 5.1.2600 Service Pack 3 4/2/2009 10:35:58 mbam-log-2009-02-04 (10-35-58).txt Tipo de Verificação: Rápida Objetos verificados: 49747 Tempo decorrido: 18 minute(s), 26 second(s) Processos da Memória infectados: 1 Módulos de Memória Infectados: 0 Chaves do Registro infectadas: 4 Valores do Registro infectados: 0 Ítens do Registro infectados: 0 Pastas infectadas: 20 Arquivos infectados: 6 Processos da Memória infectados: C:\WINDOWS\system32\SnAgOS.EXE (Trojan.Agent) -> Failed to unload process. Módulos de Memória Infectados: (Nenhum ítem malicioso foi detectado) Chaves do Registro infectadas: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\shoppingreport (Adware.Shopping.Report) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\MediaHoldings (Adware.PlayMP3Z) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully. Valores do Registro infectados: (Nenhum ítem malicioso foi detectado) Ítens do Registro infectados: (Nenhum ítem malicioso foi detectado) Pastas infectadas: C:\Documents and Settings\Administrador\Dados de aplicativos\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully. C:\Documents and Settings\Administrador\Dados de aplicativos\ShoppingReport\cs (Adware.Shopping.Report) -> Quarantined and deleted successfully. C:\Documents and Settings\Administrador\Dados de aplicativos\ShoppingReport\cs\db (Adware.Shopping.Report) -> Quarantined and deleted successfully. C:\Documents and Settings\Administrador\Dados de aplicativos\ShoppingReport\cs\dwld (Adware.Shopping.Report) -> Quarantined and deleted successfully. C:\Documents and Settings\Administrador\Dados de aplicativos\ShoppingReport\cs\report (Adware.Shopping.Report) -> Quarantined and deleted successfully. C:\Documents and Settings\Administrador\Dados de aplicativos\ShoppingReport\cs\res1 (Adware.Shopping.Report) -> Quarantined and deleted successfully. C:\Arquivos de programas\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully. C:\Arquivos de programas\ShoppingReport\Bin (Adware.Shopping.Report) -> Quarantined and deleted successfully. C:\Arquivos de programas\ShoppingReport\Bin\2.5.0 (Adware.Shopping.Report) -> Quarantined and deleted successfully. C:\Arquivos de programas\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Arquivos de programas\MyWebSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Arquivos de programas\MyWebSearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Arquivos de programas\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Arquivos de programas\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Arquivos de programas\FunWebProducts\ScreenSaver (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Arquivos de programas\FunWebProducts\ScreenSaver\Images (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Arquivos de programas\Starware406 (Adware.Starware) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Dados de aplicativos\Starware406 (Adware.Starware) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Dados de aplicativos\Starware406\buttons (Adware.Starware) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Dados de aplicativos\Starware406\contexts (Adware.Starware) -> Quarantined and deleted successfully. Arquivos infectados: C:\Arquivos de programas\ShoppingReport\Uninst.exe (Adware.Shopping.Report) -> Quarantined and deleted successfully. C:\Arquivos de programas\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Dados de aplicativos\Starware406\buttons\WeatherHot.bmp (Adware.Starware) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Dados de aplicativos\Starware406\contexts\travel.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINDOWS\system32\SnAgOS.EXE (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\lnk_dados_1.dll (Malware.Trace) -> Quarantined and deleted successfully. Compartilhar este post Link para o post Compartilhar em outros sites
Silas Martins 0 Denunciar post Postado Fevereiro 5, 2009 Baixe o RemoveIT Pro 4 v4 - SE 28 instale. Feito isso, clique em update aguarde o processo de update finalizar, e apos isto clique em Scan for viruses. Ao final do scan clique em Full report log copie o log e cole aqui, juntamente com o novo log do hijackthis. Compartilhar este post Link para o post Compartilhar em outros sites
mulher 0 Denunciar post Postado Fevereiro 5, 2009 Muito obrigado pela ajuda aqui vai os log q você solicitou!!!! Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:55:16, on 5/2/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe C:\WINDOWS\system32\SnAgOS.exe C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\system32\SnMgrSvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\wuauclt.exe C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe C:\WINDOWS\system32\ctfmon.exe C:\Arquivos de programas\Windows Live\Contacts\wlcomm.exe C:\Arquivos de programas\Internet Explorer\iexplore.exe C:\DOCUME~1\ADMINI~1\CONFIG~1\Temp\Diretório temporário 4 para HiJackThis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Arquivos de programas\Search Settings\kb126\SearchSettings.dll R3 - URLSearchHook: Barra de Ferramentas do Yahoo! - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Arquivos de programas\AskSBar\SrchAstt\2.bin\A2SRCHAS.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file) O2 - BHO: Windows Live OneCare Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Arquivos de programas\Windows Live\Proteção para a Família\fssbho.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Arquivos de programas\Search Settings\kb126\SearchSettings.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar1.dll O3 - Toolbar: Barra de Ferramentas do Yahoo! - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file) O4 - HKLM\..\Run: [searchSettings] C:\Arquivos de programas\Search Settings\SearchSettings.exe O4 - HKLM\..\Run: [fssui] "C:\Arquivos de programas\Windows Live\Proteção para a Família\fssui.exe" -autorun O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [avgnt] "C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background O4 - Startup: BrOffice.org 2.4.lnk = C:\Arquivos de programas\BrOffice.org 2.4\program\quickstart.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp O16 - DPF: {3C8B9651-4E3E-424D-B51C-54544ABF536B} (CAtmCap Object) - https://ww7.banrisul.com.br/bxz/data/securecontrol2k.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{22A5162A-CF53-40D2-BA7A-746FC3D40C24}: NameServer = 192.168.254.254 O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file) O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: SNMgrSvc - Open Communications Security S/A - C:\WINDOWS\system32\SnMgrSvc.exe -- End of file - 6660 bytes RemoveIT Pro v4 - SE (Build date: 6.6.2008) full information log file. Generated at: 5/2/2009 on 10:59:46 Microsoft Windows XP Professional Service Pack 3 (Build 2600) Author: Damjan Irgolic http://www.incodesolutions.com support@incodesolutions.com Voce tem alguns vírus no seu computador. Por favor Esquadrinhe o seu computador com RemoveIT Pro para retirar vírus descobertos. Lista de vírus: Infeccionado comSys32.FCCTRL4 - File C:\WINDOWS\system32\FCCTRL4.DLL Infeccionado comSys32.sniperiu - File C:\WINDOWS\system32\sniperiu.exe Infeccionado comSys32.url(2) - File C:\WINDOWS\system32\url(2).dll Corrida de processos: (15) C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe C:\WINDOWS\system32\SnAgOS.exe C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\system32\SnMgrSvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\ctfmon.exe C:\Arquivos de programas\InCode Solutions\RemoveIT Pro v4 - SE\removeit.exe C:\WINDOWS\system32\logon.scr Startup files: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe [C:\WINDOWS\system32\ctfmon.exe] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\swg [C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msnmsgr ["C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\SearchSettings [C:\Arquivos de programas\Search Settings\SearchSettings.exe] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\fssui ["C:\Arquivos de programas\Windows Live\Proteção para a Família\fssui.exe" -autorun] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched ["C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe"] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\avgnt ["C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min] Relatório de detalhe: (63) Clsid C:\WINDOWS\system32\crypt32.dll[e15e70be8ab77090664861fe4bddb6bf][605184] Clsid C:\WINDOWS\system32\cryptnet.dll[7cd21680f74b6d2f170db4288a563b94][64512] Clsid C:\WINDOWS\system32\cscdll.dll[7f1c91f1e0062070513a94b23bf2d84b][102400] Clsid C:\WINDOWS\system32\sclgntfy.dll[6affbcbb64792a08dee639e021384223][21504] Clsid c:\windows\system32\stobject.dll[ff266d3e7a5022a955d8be52e0c018fe][122368] Clsid c:\windows\system32\upnpui.dll[8c60c37c245d3f85502758aeb7c78fe9][239616] Clsid c:\windows\system32\webcheck.dll[07a548013ec03cd97ab5ef4e2be744d8][233472] Clsid C:\WINDOWS\system32\wgalogon.dll[7c89fd192c0d83f0c0f88152411da12a][267304] Clsid C:\WINDOWS\system32\wlnotify.dll[362bb702157e62c425c3f19a1ea86b9a][93184] Proc C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe[335a142923fe7f97e8c8388acd067568][151297] Proc C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe[d6c8942bea3698a2e7559bd423bfa5d7][68865] Proc C:\Arquivos de programas\InCode Solutions\RemoveIT Pro v4 - SE\removeit.exe[69a775f2603d4101597daa36c4d01c2b][551424] Proc C:\WINDOWS\explorer.exe[064ec7ff5f58b928c3e119402977fa6d][1035776] Proc C:\WINDOWS\system32\ctfmon.exe[4e486adfe3a0b9ed0eb0639902e9f64f][15360] Proc C:\WINDOWS\system32\logon.scr[8251cbf93ff9b5972af563742d658717][220672] Proc C:\WINDOWS\system32\lsass.exe[9607142710d3b64ab7fcce4be4e30d37][13312] Proc C:\WINDOWS\system32\services.exe[ee7999baaca84cfaa03726e677ee2a33][109056] Proc C:\WINDOWS\system32\SnAgOS.exe[93403ffdf354980a2f9fd80055d5353d][125064] Proc C:\WINDOWS\system32\SnMgrSvc.exe[53a6f5055c09ed36ec04a43f2bee78f3][280712] Proc C:\WINDOWS\system32\spoolsv.exe[af1d9ae15c11163f576df6ed6194b53c][57856] Proc C:\WINDOWS\system32\svchost.exe[ed2d69cd4b0ebe37efe11d4dc4abc68f][14336] Proc C:\WINDOWS\system32\wuauclt.exe[e654b78d2f1d791b30d0ed9a8195ec22][51224] RegRun c:\arquivos de programas\avira\antivir personaledition classic\avgnt.exe [6e812818306d460d62b4abea9fdc6679][266497] RegRun c:\arquivos de programas\google\googletoolbarnotifier\googletoolbarnotifier.exe[e616a6a6e91b0a86f2f6217cde835ffe][68856] RegRun c:\arquivos de programas\java\jre1.6.0_07\bin\jusched.exe[6ab4c021fbd36dc6764924c312428d97][144784] RegRun c:\arquivos de programas\search settings\searchsettings.exe[b67e2269c1ea2f8e5fc97eb4a71a8de0][1036640] RegRun c:\arquivos de programas\windows live\messenger\msnmsgr.exe [513d14af3235393e9025e1ba32db956e][3882312] RegRun c:\arquivos de programas\windows live\proteção para a família\fssui.exe [5eda316aae51d46d7bcf70d7bbbc8e41][243240] RegRun c:\windows\system32\ctfmon.exe[4e486adfe3a0b9ed0eb0639902e9f64f][15360] Service c:\arquivos de programas\arquivos comuns\microsoft shared\source engine\ose.exe[7a56cf3e3f12e8af599963b16f50fb6a][89136] Service c:\arquivos de programas\avira\antivir personaledition classic\avguard.exe[335a142923fe7f97e8c8388acd067568][151297] Service c:\arquivos de programas\avira\antivir personaledition classic\sched.exe[d6c8942bea3698a2e7559bd423bfa5d7][68865] Service c:\arquivos de programas\google\common\google updater\googleupdaterservice.exe[1bf044e23206fddc16891a32922d571b][137200] Service c:\arquivos de programas\windows live\proteção para a família\fsssvc.exe[04034887e76799d0a4baaa50344b3de7][523816] Service c:\windows\system32\alg.exe[6d2018aee93285f2a8bef55d722187a3][44544] Service c:\windows\system32\cisvc.exe[afe848924fcf62665fc79d2bbb5e0665][5632] Service c:\windows\system32\clipsrv.exe[bee90ff2d8f0b9c58ca33e68d6bff681][33280] Service c:\windows\system32\dllhost.exe [80557066058569bc5d55856592e20985][5120] Service c:\windows\system32\dmadmin.exe [ef80b7fee44df9848dbcdc6bde2daba4][225280] Service c:\windows\system32\imapi.exe[c8fa7f0b81c9a217c160268b892ec819][150528] Service c:\windows\system32\locator.exe[fed687d9540c8958a9f0f1816e251024][75264] Service c:\windows\system32\lsass.exe[9607142710d3b64ab7fcce4be4e30d37][13312] Service c:\windows\system32\mnmsrvc.exe[9a4d29d5f2cdf205b74bacd1029de5fe][32768] Service c:\windows\system32\msdtc.exe[c58e0367f951dacf32d801cf5f900ec5][6144] Service c:\windows\system32\msiexec.exe [275a5afe52c7440946b89215913446f5][78848] Service c:\windows\system32\netdde.exe[765433a4035c7fb8d0e21ee00dfc26b0][113664] Service c:\windows\system32\rsvp.exe[669b392eb438238e76ab120e02fb48e5][132608] Service c:\windows\system32\scardsvr.exe[b122d463c76e0305c6f0c76932969f62][99328] Service c:\windows\system32\services.exe[ee7999baaca84cfaa03726e677ee2a33][109056] Service c:\windows\system32\sessmgr.exe[51ce9301aa937291c259482a7d752f77][142848] Service c:\windows\system32\smlogsvc.exe[4aab517877a3027709f66cfeac99c2de][90624] Service c:\windows\system32\snmgrsvc.exe[53a6f5055c09ed36ec04a43f2bee78f3][280712] Service c:\windows\system32\spoolsv.exe[af1d9ae15c11163f576df6ed6194b53c][57856] Service c:\windows\system32\svchost.exe [ed2d69cd4b0ebe37efe11d4dc4abc68f][14336] Service c:\windows\system32\tlntsvr.exe[da5006fb6163e9662696cc888151667d][73728] Service c:\windows\system32\ups.exe[90f7ea72f20986d88533a99ef7d42a34][18432] Service c:\windows\system32\vssvc.exe[b919e15684e7410638fa5ee1bee4e403][292864] Service c:\windows\system32\wbem\wmiapsrv.exe[ed39d9be73cf2c95459cb029fde6ee9e][126464] Service c:\windows\system32\wdfmgr.exe[ab0a7ca90d9e3d6a193905dc1715ded0][38912] Startup c:\arquivos de programas\broffice.org 2.4\program\quickstart.exe[f5ceccfe0cf964b209dcab226d4c1de3][393216] Startup c:\documents and settings\administrador\menu iniciar\programas\inicializar\desktop.ini[d6a6856702e3f0953e7246a9b4a9fe35][84] Startup c:\documents and settings\all users\menu iniciar\programas\inicializar\desktop.ini[d6a6856702e3f0953e7246a9b4a9fe35][84] System.ini c:\windows\system32\wdfmgr.exe[ab0a7ca90d9e3d6a193905dc1715ded0][38912] Startup folder: (3) Startup name: BrOffice.org 2.4.lnk Command: C:\Arquivos de programas\BrOffice.org 2.4\program\quickstart.exe Startup name: desktop.ini Command: C:\Documents and Settings\Administrador\Menu Iniciar\Programas\Inicializar\desktop.ini Startup name: desktop.ini Command: C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\desktop.ini Win.ini Startup: (1) Path: No additional driver found! Win.ini Startup: (1) Path: No additional driver found! Keyboard drivers: (1) Name: No Keyboard Filter driver found! Services: (91) Service Name: Acesso a dispositivo de interface humana [stopped], Path: C:\WINDOWS\System32\svchost.exe -k netsvcs Service Name: Adaptador de desempenho WMI [stopped], Path: C:\WINDOWS\system32\wbem\wmiapsrv.exe Service Name: Agendador de tarefas [Running], Path: C:\WINDOWS\System32\svchost.exe -k netsvcs Service Name: Agente de Proteção de Acesso à Rede [stopped], Path: C:\WINDOWS\System32\svchost.exe -k netsvcs Service Name: Ajuda e suporte [Running], Path: C:\WINDOWS\System32\svchost.exe -k netsvcs Service Name: Alerta [stopped], Path: C:\WINDOWS\system32\svchost.exe -k LocalService Service Name: Alocador Remote Procedure Call (RPC) [stopped], Path: C:\WINDOWS\system32\locator.exe Service Name: Aplicativo de sistema COM+ [stopped], Path: C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} Service Name: Área de armazenamento [stopped], Path: C:\WINDOWS\system32\clipsrv.exe Service Name: Armazenamento protegido [stopped], Path: C:\WINDOWS\system32\lsass.exe Service Name: Armazenamento removível [stopped], Path: C:\WINDOWS\system32\svchost.exe -k netsvcs Service Name: Assistente de aquisição de imagens do Windows (WIA) [stopped], Path: C:\WINDOWS\system32\svchost.exe -k imgsvc Service Name: Atualizações Automáticas [Running], Path: C:\WINDOWS\system32\svchost.exe -k netsvcs Service Name: Áudio do Windows [Running], Path: C:\WINDOWS\System32\svchost.exe -k netsvcs Service Name: Auxiliar NetBIOS TCP/IP [Running], Path: C:\WINDOWS\system32\svchost.exe -k LocalService Service Name: Avira AntiVir Personal - Free Antivirus Guard [Running], Path: "C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe" Service Name: Avira AntiVir Personal - Free Antivirus Scheduler [Running], Path: "C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe" Service Name: Cartão inteligente [stopped], Path: C:\WINDOWS\System32\SCardSvr.exe Service Name: Central de Segurança [Running], Path: C:\WINDOWS\System32\svchost.exe -k netsvcs Service Name: Chamada de procedimento remoto (RPC) [Running], Path: C:\WINDOWS\system32\svchost -k rpcss Service Name: Cliente da Web [Running], Path: C:\WINDOWS\system32\svchost.exe -k LocalService Service Name: Cliente de rastreamento de link distribuído [Running], Path: C:\WINDOWS\system32\svchost.exe -k netsvcs Service Name: Cliente DHCP [Running], Path: C:\WINDOWS\system32\svchost.exe -k netsvcs Service Name: Cliente DNS [Running], Path: C:\WINDOWS\system32\svchost.exe -k NetworkService Service Name: Compartilhamento remoto da área de trabalho do NetMeeting [stopped], Path: C:\WINDOWS\system32\mnmsrvc.exe Service Name: Compatibilidade com 'Troca rápida de usuário' [stopped], Path: C:\WINDOWS\System32\svchost.exe -k netsvcs Service Name: Conexões de rede [Running], Path: C:\WINDOWS\System32\svchost.exe -k netsvcs Service Name: Configuração Automática com Fio [stopped], Path: C:\WINDOWS\System32\svchost.exe -k dot3svc Service Name: Configuração zero sem fio [Running], Path: C:\WINDOWS\System32\svchost.exe -k netsvcs Service Name: Coordenador de transações distribuídas [stopped], Path: C:\WINDOWS\system32\msdtc.exe Service Name: Cópia de volume em memória [stopped], Path: C:\WINDOWS\System32\vssvc.exe Service Name: DDE de rede [stopped], Path: C:\WINDOWS\system32\netdde.exe Service Name: Detecção do hardware do shell [Running], Path: C:\WINDOWS\System32\svchost.exe -k netsvcs Service Name: DSDM de DDE de rede [stopped], Path: C:\WINDOWS\system32\netdde.exe Service Name: Erro ao informar o serviço [stopped], Path: C:\WINDOWS\System32\svchost.exe -k netsvcs Service Name: Estação de trabalho [Running], Path: C:\WINDOWS\system32\svchost.exe -k netsvcs Service Name: Extensões de driver de instrum. gerenc. do Windows [stopped], Path: C:\WINDOWS\System32\svchost.exe -k netsvcs Service Name: Firewall do Windows/Compartilhamento de Conexão com a Internet (ICS) [Running], Path: C:\WINDOWS\system32\svchost.exe -k netsvcs Service Name: Fornecedor de suporte de segurança NT LM [stopped], Path: C:\WINDOWS\system32\lsass.exe Service Name: Gerenciador de conexão de acesso remoto [Running], Path: C:\WINDOWS\system32\svchost.exe -k netsvcs Service Name: Gerenciador de conexão de acesso remoto automático [stopped], Path: C:\WINDOWS\system32\svchost.exe -k netsvcs Service Name: Gerenciador de contas de segurança [Running], Path: C:\WINDOWS\system32\lsass.exe Service Name: Gerenciador de discos lógicos [Running], Path: C:\WINDOWS\System32\svchost.exe -k netsvcs Service Name: Gerenciador de sessão de ajuda de área de trabalho remota [stopped], Path: C:\WINDOWS\system32\sessmgr.exe Service Name: Gerenciamento de aplicativo [stopped], Path: C:\WINDOWS\system32\svchost.exe -k netsvcs Service Name: Google Updater Service [stopped], Path: "C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe" Service Name: Horário do Windows [Running], Path: C:\WINDOWS\System32\svchost.exe -k netsvcs Service Name: Host de dispositivo Plug and Play universal [stopped], Path: C:\WINDOWS\system32\svchost.exe -k LocalService Service Name: HTTP SSL [Running], Path: C:\WINDOWS\System32\svchost.exe -k HTTPFilter Service Name: IMAPI CD-Burning COM Service [stopped], Path: C:\WINDOWS\system32\imapi.exe Service Name: Inicializador de Processo de Servidor DCOM [Running], Path: C:\WINDOWS\system32\svchost -k DcomLaunch Service Name: Localizador de computadores [stopped], Path: C:\WINDOWS\system32\svchost.exe -k netsvcs Service Name: Log de eventos [Running], Path: C:\WINDOWS\system32\services.exe Service Name: Logon de rede [stopped], Path: C:\WINDOWS\system32\lsass.exe Service Name: Logon secundário [Running], Path: C:\WINDOWS\System32\svchost.exe -k netsvcs Service Name: Logs e alertas de desempenho [stopped], Path: C:\WINDOWS\system32\smlogsvc.exe Service Name: Mensageiro [stopped], Path: C:\WINDOWS\system32\svchost.exe -k netsvcs Service Name: MS Software Shadow Copy Provider [stopped], Path: C:\WINDOWS\system32\dllhost.exe /Processid:{9169CB9E-DB4A-4DB2-8B69-3F144C800046} Service Name: Notificação de eventos de sistema [Running], Path: C:\WINDOWS\system32\svchost.exe -k netsvcs Service Name: Office Source Engine [stopped], Path: "C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Source Engine\OSE.EXE" Service Name: Plug and Play [Running], Path: C:\WINDOWS\system32\services.exe Service Name: Portable Media Serial Number Service [stopped], Path: C:\WINDOWS\System32\svchost.exe -k netsvcs Service Name: QoS RSVP [stopped], Path: C:\WINDOWS\system32\rsvp.exe Service Name: Reconhecimento de local da rede (NLA) [Running], Path: C:\WINDOWS\system32\svchost.exe -k netsvcs Service Name: Registro remoto [stopped], Path: C:\WINDOWS\system32\svchost.exe -k LocalService Service Name: Roteamento e acesso remoto [stopped], Path: C:\WINDOWS\system32\svchost.exe -k netsvcs Service Name: Serviço administrativo do gerenciador de disco lógico [stopped], Path: C:\WINDOWS\System32\dmadmin.exe /com Service Name: Serviço de Configuração de Rede [stopped], Path: C:\WINDOWS\System32\svchost.exe -k netsvcs Service Name: Serviço de descoberta SSDP [Running], Path: C:\WINDOWS\system32\svchost.exe -k LocalService Service Name: Serviço de EAP (Extensible Authentication Protocol) [stopped], Path: C:\WINDOWS\System32\svchost.exe -k eapsvcs Service Name: Serviço de Gerenciamento de Certificados e Chaves de Integridade [stopped], Path: C:\WINDOWS\System32\svchost.exe -k netsvcs Service Name: Serviço de indexação [stopped], Path: C:\WINDOWS\system32\cisvc.exe Service Name: Serviço de restauração do sistema [Running], Path: C:\WINDOWS\system32\svchost.exe -k netsvcs Service Name: Serviço de transferência inteligente de plano de fundo [stopped], Path: C:\WINDOWS\system32\svchost.exe -k netsvcs Service Name: Serviço 'Gateway de camada de aplicativo' [Running], Path: C:\WINDOWS\System32\alg.exe Service Name: Serviços de criptografia [Running], Path: C:\WINDOWS\system32\svchost.exe -k netsvcs Service Name: Serviços de terminal [Running], Path: C:\WINDOWS\System32\svchost -k DComLaunch Service Name: Serviços IPSEC [Running], Path: C:\WINDOWS\system32\lsass.exe Service Name: Servidor [Running], Path: C:\WINDOWS\system32\svchost.exe -k netsvcs Service Name: Sistema de alimentação ininterrupta [stopped], Path: C:\WINDOWS\System32\ups.exe Service Name: Sistema de eventos COM+ [Running], Path: C:\WINDOWS\system32\svchost.exe -k netsvcs Service Name: SNMgrSvc [Running], Path: "C:\WINDOWS\system32\SnMgrSvc.exe" Service Name: Spooler de impressão [Running], Path: C:\WINDOWS\system32\spoolsv.exe Service Name: Telefonia [Running], Path: C:\WINDOWS\System32\svchost.exe -k netsvcs Service Name: Telnet [stopped], Path: C:\WINDOWS\system32\tlntsvr.exe Service Name: Temas [Running], Path: C:\WINDOWS\System32\svchost.exe -k netsvcs Service Name: Testador de instrumentação de gerenciam. do Windows [Running], Path: C:\WINDOWS\system32\svchost.exe -k netsvcs Service Name: Windows Driver Foundation - User-mode Driver Framework [stopped], Path: C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup Service Name: Windows Installer [stopped], Path: C:\WINDOWS\system32\msiexec.exe /V Service Name: Windows Live OneCare Proteção para a Família [Running], Path: "C:\Arquivos de programas\Windows Live\Proteção para a Família\fsssvc.exe" Service Name: Windows User Mode Driver Framework [Running], Path: C:\WINDOWS\system32\wdfmgr.exe Terminado... Compartilhar este post Link para o post Compartilhar em outros sites
Silas Martins 0 Denunciar post Postado Fevereiro 6, 2009 Siga as instruções abaixo: Baixe o Killbox Execute o KillBox,clique em Delete on Reboot. Copie a lista abaixo: C:\WINDOWS\system32\FCCTRL4.DLLC:\WINDOWS\system32\sniperiu.exe C:\WINDOWS\system32\url(2).dll C:\Arquivos de programas\Search Settings\kb126\SearchSettings.dll C:\Arquivos de programas\Search Settings\SearchSettings.exe Vá ao Killbox.E clique em File > Paste from clipboard. Clique em All Files. Pressione "X". Responda "NÃO" à pergunta. Reinicie o computador em Modo Seguro (após reiniciar aperte a tecla F8 repetidamente até aparecer uma tela preta em DOS e escolha Modo Seguro). Execute o HijackThis, clique em Do a system scan only e selecione as linhas: R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Arquivos de programas\Search Settings\kb126\SearchSettings.dllO2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Arquivos de programas\Search Settings\kb126\SearchSettings.dll O4 - HKLM\..\Run: [searchSettings] C:\Arquivos de programas\Search Settings\SearchSettings.exe Clique em Fix Checked Feito isso Reinicie em modo normal e gere um novo log do Hijackthis. Aguardo retorno. Compartilhar este post Link para o post Compartilhar em outros sites
mulher 0 Denunciar post Postado Fevereiro 6, 2009 Fiz oq solicitou esqueci de dizer q a pagina com papel de parede apagou a tela esta preta com icones iguais no lado direito aparece dizendo q o windows é falsificado VALEU abraços aguardo por você..... Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 08:44:31, on 6/2/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe C:\WINDOWS\system32\WgaTray.exe C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\system32\SnAgOS.exe C:\WINDOWS\system32\SnMgrSvc.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\System32\svchost.exe C:\Arquivos de programas\Windows Live\Proteção para a Família\fssui.exe C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe C:\Arquivos de programas\BrOffice.org 2.4\program\soffice.exe C:\Arquivos de programas\Internet Explorer\iexplore.exe C:\Arquivos de programas\BrOffice.org 2.4\program\soffice.BIN C:\Arquivos de programas\Internet Explorer\iexplore.exe C:\WINDOWS\system32\wuauclt.exe C:\DOCUME~1\ADMINI~1\CONFIG~1\Temp\Diretório temporário 6 para HiJackThis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R3 - URLSearchHook: Barra de Ferramentas do Yahoo! - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Arquivos de programas\AskSBar\SrchAstt\2.bin\A2SRCHAS.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file) O2 - BHO: Windows Live OneCare Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Arquivos de programas\Windows Live\Proteção para a Família\fssbho.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar1.dll O3 - Toolbar: Barra de Ferramentas do Yahoo! - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file) O4 - HKLM\..\Run: [fssui] "C:\Arquivos de programas\Windows Live\Proteção para a Família\fssui.exe" -autorun O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [avgnt] "C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background O4 - Startup: BrOffice.org 2.4.lnk = C:\Arquivos de programas\BrOffice.org 2.4\program\quickstart.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp O16 - DPF: {3C8B9651-4E3E-424D-B51C-54544ABF536B} (CAtmCap Object) - https://ww7.banrisul.com.br/bxz/data/securecontrol2k.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{22A5162A-CF53-40D2-BA7A-746FC3D40C24}: NameServer = 192.168.254.254 O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file) O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: SNMgrSvc - Open Communications Security S/A - C:\WINDOWS\system32\SnMgrSvc.exe -- End of file - 6749 bytes Compartilhar este post Link para o post Compartilhar em outros sites
Silas Martins 0 Denunciar post Postado Fevereiro 7, 2009 Log limpo Fiz oq solicitou esqueci de dizer q a pagina com papel de parede apagou a tela esta preta com icones iguais no lado direito aparece dizendo q o windows é falsificado Isso ocorreu quando, antes ou depois do de você utilizar as ferramentas de remoção?, e outra coisa se lembra de fazer download no site da microsoft?Aguardo retorno. Compartilhar este post Link para o post Compartilhar em outros sites
mulher 0 Denunciar post Postado Fevereiro 7, 2009 Ola Silas Ocorria antes de ficar sem papel de parede, mas agora não abre mais nem mais a pagina do windows apenas aparece uma pagina preta com esse escrito embaixo de falso.... tentei fazer de tudo mas sou muito leiga em relação a isso então.... aguardo retorno....Valeu bom findi Compartilhar este post Link para o post Compartilhar em outros sites
Silas Martins 0 Denunciar post Postado Fevereiro 7, 2009 Já tentou a restauração do sistema? Creio que o seu caso seja para uma restauração ou então utilizar o cd do XP para recuperar o S.O Compartilhar este post Link para o post Compartilhar em outros sites
mulher 0 Denunciar post Postado Fevereiro 9, 2009 Ja tentei restauração, e sobre o cd não possuo qdo comprei o notebook veio instalado mas sem cd tem outra forma....obrigado Compartilhar este post Link para o post Compartilhar em outros sites
Silas Martins 0 Denunciar post Postado Fevereiro 9, 2009 Seu Windows é original? Compartilhar este post Link para o post Compartilhar em outros sites
mulher 0 Denunciar post Postado Fevereiro 10, 2009 Ola logo acima lhe disse q aparecia um icone no lado direito dizendo q a copia do windows era pirata..... Compartilhar este post Link para o post Compartilhar em outros sites
Silas Martins 0 Denunciar post Postado Fevereiro 10, 2009 Esse alerta é do WGA ele pode ser removido, mas isso é contra a lei. Vou tratar aqui somente da desinfecção do pc no mais procure auxilio para o XP em fóruns especializado em Sistemas operacionais. Siga as instruções abaixo: Baixe o SDFix e e arquive na sua área de trabalho. *Execute o SDFix.exe[/b] clicando duas vezes sobre ele. * Permitam-lo para instalar na localização padrão, que é normalmente c: \ SDFix * Agora, por favor, reinicie o computador em modo de segurança (Reinicie o computador e segure a tecla F8 sem solta-la até que seja disponibilizada a tela onde você opte por modo de segurança) * Depois de ter arrancado em modo seguro, abra o C: \ SDFix pasta e dê um duplo clique em RunThis.bat para iniciar o script. * Aperte Y para iniciar a limpeza do processo. * Ele irá remover qualquer Tróia ou Serviços Secretaria entradas encontradas e, em seguida, pedir-lhe para pressione qualquer tecla para reiniciar. * Pressione qualquer tecla e ele irá reiniciar o PC. * Quando o PC reinicia a Fixtool irá correr de novo e completar o processo de remoção exibição terminados em seguida, pressione qualquer tecla para terminar o script e carregar seu desktop ícones. * Depois de a carregar os ícones desktop SDFix relatório será aberta a tela e também em salvar a pasta SDFix como Report.txt. *Poste o Report.txt juntamente com novo log do hijackthis gerado em modo normal. Compartilhar este post Link para o post Compartilhar em outros sites
Mário Monteiro 179 Denunciar post Postado Março 11, 2009 Tópico Arquivado Como o autor não respondeu por mais de 30 dias, o tópico foi arquivado. Caso você seja o autor do tópico e quer reabrir, envie uma mensagem privada para um moderador da área juntamente com o link para este tópico e explique o motivo da reabertura. Compartilhar este post Link para o post Compartilhar em outros sites
