[Arquivado] log do hijackthis

[mulher 0]

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 09:49:03, on 4/2/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\WINDOWS\system32\WgaTray.exe

C:\WINDOWS\system32\SnMgrSvc.exe

C:\WINDOWS\system32\SnAgOS.exe

C:\WINDOWS\system32\SnLiveUp.exe

C:\WINDOWS\Explorer.exe

C:\Arquivos de programas\Search Settings\SearchSettings.exe

C:\Arquivos de programas\Windows Live\Proteção para a Família\fssui.exe

C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Arquivos de programas\Windows Live\Contacts\wlcomm.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\DOCUME~1\ADMINI~1\CONFIG~1\Temp\Diretório temporário 3 para HiJackThis.zip\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Arquivos de programas\Search Settings\kb126\SearchSettings.dll

R3 - URLSearchHook: Barra de Ferramentas do Yahoo! - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Arquivos de programas\AskSBar\SrchAstt\2.bin\A2SRCHAS.DLL

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)

O2 - BHO: Windows Live OneCare Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Arquivos de programas\Windows Live\Proteção para a Família\fssbho.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll

O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Arquivos de programas\Search Settings\kb126\SearchSettings.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar1.dll

O3 - Toolbar: Barra de Ferramentas do Yahoo! - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)

O4 - HKLM\..\Run: [searchSettings] C:\Arquivos de programas\Search Settings\SearchSettings.exe

O4 - HKLM\..\Run: [fssui] "C:\Arquivos de programas\Windows Live\Proteção para a Família\fssui.exe" -autorun

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background

O4 - Startup: BrOffice.org 2.4.lnk = C:\Arquivos de programas\BrOffice.org 2.4\program\quickstart.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {3C8B9651-4E3E-424D-B51C-54544ABF536B} (CAtmCap Object) - https://ww7.banrisul.com.br/bxz/data/securecontrol2k.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{22A5162A-CF53-40D2-BA7A-746FC3D40C24}: NameServer = 192.168.254.254

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: SNMgrSvc - Open Communications Security S/A - C:\WINDOWS\system32\SnMgrSvc.exe

 

--

End of file - 7075 bytes

 

 

 

 

Esse log

 

Malwarebytes' Anti-Malware 1.33

Versão do banco de dados: 1716

Windows 5.1.2600 Service Pack 3

 

4/2/2009 10:35:58

mbam-log-2009-02-04 (10-35-58).txt

 

Tipo de Verificação: Rápida

Objetos verificados: 49747

Tempo decorrido: 18 minute(s), 26 second(s)

 

Processos da Memória infectados: 1

Módulos de Memória Infectados: 0

Chaves do Registro infectadas: 4

Valores do Registro infectados: 0

Ítens do Registro infectados: 0

Pastas infectadas: 20

Arquivos infectados: 6

 

Processos da Memória infectados:

C:\WINDOWS\system32\SnAgOS.EXE (Trojan.Agent) -> Failed to unload process.

 

Módulos de Memória Infectados:

(Nenhum ítem malicioso foi detectado)

 

Chaves do Registro infectadas:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\shoppingreport (Adware.Shopping.Report) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\MediaHoldings (Adware.PlayMP3Z) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully.

 

Valores do Registro infectados:

(Nenhum ítem malicioso foi detectado)

 

Ítens do Registro infectados:

(Nenhum ítem malicioso foi detectado)

 

Pastas infectadas:

C:\Documents and Settings\Administrador\Dados de aplicativos\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully.

C:\Documents and Settings\Administrador\Dados de aplicativos\ShoppingReport\cs (Adware.Shopping.Report) -> Quarantined and deleted successfully.

C:\Documents and Settings\Administrador\Dados de aplicativos\ShoppingReport\cs\db (Adware.Shopping.Report) -> Quarantined and deleted successfully.

C:\Documents and Settings\Administrador\Dados de aplicativos\ShoppingReport\cs\dwld (Adware.Shopping.Report) -> Quarantined and deleted successfully.

C:\Documents and Settings\Administrador\Dados de aplicativos\ShoppingReport\cs\report (Adware.Shopping.Report) -> Quarantined and deleted successfully.

C:\Documents and Settings\Administrador\Dados de aplicativos\ShoppingReport\cs\res1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.

C:\Arquivos de programas\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully.

C:\Arquivos de programas\ShoppingReport\Bin (Adware.Shopping.Report) -> Quarantined and deleted successfully.

C:\Arquivos de programas\ShoppingReport\Bin\2.5.0 (Adware.Shopping.Report) -> Quarantined and deleted successfully.

C:\Arquivos de programas\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\Arquivos de programas\MyWebSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\Arquivos de programas\MyWebSearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\Arquivos de programas\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\Arquivos de programas\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\Arquivos de programas\FunWebProducts\ScreenSaver (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\Arquivos de programas\FunWebProducts\ScreenSaver\Images (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\Arquivos de programas\Starware406 (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Dados de aplicativos\Starware406 (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Dados de aplicativos\Starware406\buttons (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Dados de aplicativos\Starware406\contexts (Adware.Starware) -> Quarantined and deleted successfully.

 

Arquivos infectados:

C:\Arquivos de programas\ShoppingReport\Uninst.exe (Adware.Shopping.Report) -> Quarantined and deleted successfully.

C:\Arquivos de programas\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Dados de aplicativos\Starware406\buttons\WeatherHot.bmp (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Dados de aplicativos\Starware406\contexts\travel.xml (Adware.Starware) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\SnAgOS.EXE (Trojan.Agent) -> Delete on reboot.

C:\WINDOWS\lnk_dados_1.dll (Malware.Trace) -> Quarantined and deleted successfully.

[Silas Martins 0]

Baixe o RemoveIT Pro 4 v4 - SE 28 instale.

Feito isso, clique em update aguarde o processo de update finalizar, e apos isto clique em Scan for viruses.

Ao final do scan clique em Full report log copie o log e cole aqui, juntamente com o novo log do hijackthis.

[mulher 0]

Muito obrigado pela ajuda aqui vai os log q você solicitou!!!!

 

 

 

 

 

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:55:16, on 5/2/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\WINDOWS\system32\SnAgOS.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\WINDOWS\system32\SnMgrSvc.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Windows Live\Contacts\wlcomm.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\DOCUME~1\ADMINI~1\CONFIG~1\Temp\Diretório temporário 4 para HiJackThis.zip\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Arquivos de programas\Search Settings\kb126\SearchSettings.dll

R3 - URLSearchHook: Barra de Ferramentas do Yahoo! - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Arquivos de programas\AskSBar\SrchAstt\2.bin\A2SRCHAS.DLL

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)

O2 - BHO: Windows Live OneCare Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Arquivos de programas\Windows Live\Proteção para a Família\fssbho.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll

O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Arquivos de programas\Search Settings\kb126\SearchSettings.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar1.dll

O3 - Toolbar: Barra de Ferramentas do Yahoo! - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)

O4 - HKLM\..\Run: [searchSettings] C:\Arquivos de programas\Search Settings\SearchSettings.exe

O4 - HKLM\..\Run: [fssui] "C:\Arquivos de programas\Windows Live\Proteção para a Família\fssui.exe" -autorun

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background

O4 - Startup: BrOffice.org 2.4.lnk = C:\Arquivos de programas\BrOffice.org 2.4\program\quickstart.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {3C8B9651-4E3E-424D-B51C-54544ABF536B} (CAtmCap Object) - https://ww7.banrisul.com.br/bxz/data/securecontrol2k.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{22A5162A-CF53-40D2-BA7A-746FC3D40C24}: NameServer = 192.168.254.254

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: SNMgrSvc - Open Communications Security S/A - C:\WINDOWS\system32\SnMgrSvc.exe

 

--

End of file - 6660 bytes

 

 

 

 

 

 

 

 

RemoveIT Pro v4 - SE (Build date: 6.6.2008) full information log file.

Generated at: 5/2/2009 on 10:59:46

Microsoft Windows XP Professional Service Pack 3 (Build 2600)

Author: Damjan Irgolic

http://www.incodesolutions.com

support@incodesolutions.com

 

 

Voce tem alguns vírus no seu computador.

Por favor Esquadrinhe o seu computador com RemoveIT Pro para retirar vírus descobertos.

Lista de vírus:

Infeccionado comSys32.FCCTRL4 - File C:\WINDOWS\system32\FCCTRL4.DLL

Infeccionado comSys32.sniperiu - File C:\WINDOWS\system32\sniperiu.exe

Infeccionado comSys32.url(2) - File C:\WINDOWS\system32\url(2).dll

 

Corrida de processos: (15)

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\WINDOWS\system32\SnAgOS.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\WINDOWS\system32\SnMgrSvc.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\InCode Solutions\RemoveIT Pro v4 - SE\removeit.exe

C:\WINDOWS\system32\logon.scr

 

Startup files:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe

[C:\WINDOWS\system32\ctfmon.exe]

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\swg

[C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe]

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msnmsgr

["C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background]

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\SearchSettings

[C:\Arquivos de programas\Search Settings\SearchSettings.exe]

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\fssui

["C:\Arquivos de programas\Windows Live\Proteção para a Família\fssui.exe" -autorun]

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched

["C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe"]

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\avgnt

["C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min]

 

Relatório de detalhe: (63)

Clsid C:\WINDOWS\system32\crypt32.dll[e15e70be8ab77090664861fe4bddb6bf][605184]

Clsid C:\WINDOWS\system32\cryptnet.dll[7cd21680f74b6d2f170db4288a563b94][64512]

Clsid C:\WINDOWS\system32\cscdll.dll[7f1c91f1e0062070513a94b23bf2d84b][102400]

Clsid C:\WINDOWS\system32\sclgntfy.dll[6affbcbb64792a08dee639e021384223][21504]

Clsid c:\windows\system32\stobject.dll[ff266d3e7a5022a955d8be52e0c018fe][122368]

Clsid c:\windows\system32\upnpui.dll[8c60c37c245d3f85502758aeb7c78fe9][239616]

Clsid c:\windows\system32\webcheck.dll[07a548013ec03cd97ab5ef4e2be744d8][233472]

Clsid C:\WINDOWS\system32\wgalogon.dll[7c89fd192c0d83f0c0f88152411da12a][267304]

Clsid C:\WINDOWS\system32\wlnotify.dll[362bb702157e62c425c3f19a1ea86b9a][93184]

Proc C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe[335a142923fe7f97e8c8388acd067568][151297]

Proc C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe[d6c8942bea3698a2e7559bd423bfa5d7][68865]

Proc C:\Arquivos de programas\InCode Solutions\RemoveIT Pro v4 - SE\removeit.exe[69a775f2603d4101597daa36c4d01c2b][551424]

Proc C:\WINDOWS\explorer.exe[064ec7ff5f58b928c3e119402977fa6d][1035776]

Proc C:\WINDOWS\system32\ctfmon.exe[4e486adfe3a0b9ed0eb0639902e9f64f][15360]

Proc C:\WINDOWS\system32\logon.scr[8251cbf93ff9b5972af563742d658717][220672]

Proc C:\WINDOWS\system32\lsass.exe[9607142710d3b64ab7fcce4be4e30d37][13312]

Proc C:\WINDOWS\system32\services.exe[ee7999baaca84cfaa03726e677ee2a33][109056]

Proc C:\WINDOWS\system32\SnAgOS.exe[93403ffdf354980a2f9fd80055d5353d][125064]

Proc C:\WINDOWS\system32\SnMgrSvc.exe[53a6f5055c09ed36ec04a43f2bee78f3][280712]

Proc C:\WINDOWS\system32\spoolsv.exe[af1d9ae15c11163f576df6ed6194b53c][57856]

Proc C:\WINDOWS\system32\svchost.exe[ed2d69cd4b0ebe37efe11d4dc4abc68f][14336]

Proc C:\WINDOWS\system32\wuauclt.exe[e654b78d2f1d791b30d0ed9a8195ec22][51224]

RegRun c:\arquivos de programas\avira\antivir personaledition classic\avgnt.exe [6e812818306d460d62b4abea9fdc6679][266497]

RegRun c:\arquivos de programas\google\googletoolbarnotifier\googletoolbarnotifier.exe[e616a6a6e91b0a86f2f6217cde835ffe][68856]

RegRun c:\arquivos de programas\java\jre1.6.0_07\bin\jusched.exe[6ab4c021fbd36dc6764924c312428d97][144784]

RegRun c:\arquivos de programas\search settings\searchsettings.exe[b67e2269c1ea2f8e5fc97eb4a71a8de0][1036640]

RegRun c:\arquivos de programas\windows live\messenger\msnmsgr.exe [513d14af3235393e9025e1ba32db956e][3882312]

RegRun c:\arquivos de programas\windows live\proteção para a família\fssui.exe [5eda316aae51d46d7bcf70d7bbbc8e41][243240]

RegRun c:\windows\system32\ctfmon.exe[4e486adfe3a0b9ed0eb0639902e9f64f][15360]

Service c:\arquivos de programas\arquivos comuns\microsoft shared\source engine\ose.exe[7a56cf3e3f12e8af599963b16f50fb6a][89136]

Service c:\arquivos de programas\avira\antivir personaledition classic\avguard.exe[335a142923fe7f97e8c8388acd067568][151297]

Service c:\arquivos de programas\avira\antivir personaledition classic\sched.exe[d6c8942bea3698a2e7559bd423bfa5d7][68865]

Service c:\arquivos de programas\google\common\google updater\googleupdaterservice.exe[1bf044e23206fddc16891a32922d571b][137200]

Service c:\arquivos de programas\windows live\proteção para a família\fsssvc.exe[04034887e76799d0a4baaa50344b3de7][523816]

Service c:\windows\system32\alg.exe[6d2018aee93285f2a8bef55d722187a3][44544]

Service c:\windows\system32\cisvc.exe[afe848924fcf62665fc79d2bbb5e0665][5632]

Service c:\windows\system32\clipsrv.exe[bee90ff2d8f0b9c58ca33e68d6bff681][33280]

Service c:\windows\system32\dllhost.exe [80557066058569bc5d55856592e20985][5120]

Service c:\windows\system32\dmadmin.exe [ef80b7fee44df9848dbcdc6bde2daba4][225280]

Service c:\windows\system32\imapi.exe[c8fa7f0b81c9a217c160268b892ec819][150528]

Service c:\windows\system32\locator.exe[fed687d9540c8958a9f0f1816e251024][75264]

Service c:\windows\system32\lsass.exe[9607142710d3b64ab7fcce4be4e30d37][13312]

Service c:\windows\system32\mnmsrvc.exe[9a4d29d5f2cdf205b74bacd1029de5fe][32768]

Service c:\windows\system32\msdtc.exe[c58e0367f951dacf32d801cf5f900ec5][6144]

Service c:\windows\system32\msiexec.exe [275a5afe52c7440946b89215913446f5][78848]

Service c:\windows\system32\netdde.exe[765433a4035c7fb8d0e21ee00dfc26b0][113664]

Service c:\windows\system32\rsvp.exe[669b392eb438238e76ab120e02fb48e5][132608]

Service c:\windows\system32\scardsvr.exe[b122d463c76e0305c6f0c76932969f62][99328]

Service c:\windows\system32\services.exe[ee7999baaca84cfaa03726e677ee2a33][109056]

Service c:\windows\system32\sessmgr.exe[51ce9301aa937291c259482a7d752f77][142848]

Service c:\windows\system32\smlogsvc.exe[4aab517877a3027709f66cfeac99c2de][90624]

Service c:\windows\system32\snmgrsvc.exe[53a6f5055c09ed36ec04a43f2bee78f3][280712]

Service c:\windows\system32\spoolsv.exe[af1d9ae15c11163f576df6ed6194b53c][57856]

Service c:\windows\system32\svchost.exe [ed2d69cd4b0ebe37efe11d4dc4abc68f][14336]

Service c:\windows\system32\tlntsvr.exe[da5006fb6163e9662696cc888151667d][73728]

Service c:\windows\system32\ups.exe[90f7ea72f20986d88533a99ef7d42a34][18432]

Service c:\windows\system32\vssvc.exe[b919e15684e7410638fa5ee1bee4e403][292864]

Service c:\windows\system32\wbem\wmiapsrv.exe[ed39d9be73cf2c95459cb029fde6ee9e][126464]

Service c:\windows\system32\wdfmgr.exe[ab0a7ca90d9e3d6a193905dc1715ded0][38912]

Startup c:\arquivos de programas\broffice.org 2.4\program\quickstart.exe[f5ceccfe0cf964b209dcab226d4c1de3][393216]

Startup c:\documents and settings\administrador\menu iniciar\programas\inicializar\desktop.ini[d6a6856702e3f0953e7246a9b4a9fe35][84]

Startup c:\documents and settings\all users\menu iniciar\programas\inicializar\desktop.ini[d6a6856702e3f0953e7246a9b4a9fe35][84]

System.ini c:\windows\system32\wdfmgr.exe[ab0a7ca90d9e3d6a193905dc1715ded0][38912]

 

Startup folder: (3)

Startup name: BrOffice.org 2.4.lnk

Command: C:\Arquivos de programas\BrOffice.org 2.4\program\quickstart.exe

Startup name: desktop.ini

Command: C:\Documents and Settings\Administrador\Menu Iniciar\Programas\Inicializar\desktop.ini

Startup name: desktop.ini

Command: C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\desktop.ini

 

Win.ini Startup: (1)

Path: No additional driver found!

 

Win.ini Startup: (1)

Path: No additional driver found!

 

Keyboard drivers: (1)

Name: No Keyboard Filter driver found!

 

Services: (91)

Service Name: Acesso a dispositivo de interface humana [stopped],

Path: C:\WINDOWS\System32\svchost.exe -k netsvcs

Service Name: Adaptador de desempenho WMI [stopped],

Path: C:\WINDOWS\system32\wbem\wmiapsrv.exe

Service Name: Agendador de tarefas [Running],

Path: C:\WINDOWS\System32\svchost.exe -k netsvcs

Service Name: Agente de Proteção de Acesso à Rede [stopped],

Path: C:\WINDOWS\System32\svchost.exe -k netsvcs

Service Name: Ajuda e suporte [Running],

Path: C:\WINDOWS\System32\svchost.exe -k netsvcs

Service Name: Alerta [stopped],

Path: C:\WINDOWS\system32\svchost.exe -k LocalService

Service Name: Alocador Remote Procedure Call (RPC) [stopped],

Path: C:\WINDOWS\system32\locator.exe

Service Name: Aplicativo de sistema COM+ [stopped],

Path: C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

Service Name: Área de armazenamento [stopped],

Path: C:\WINDOWS\system32\clipsrv.exe

Service Name: Armazenamento protegido [stopped],

Path: C:\WINDOWS\system32\lsass.exe

Service Name: Armazenamento removível [stopped],

Path: C:\WINDOWS\system32\svchost.exe -k netsvcs

Service Name: Assistente de aquisição de imagens do Windows (WIA) [stopped],

Path: C:\WINDOWS\system32\svchost.exe -k imgsvc

Service Name: Atualizações Automáticas [Running],

Path: C:\WINDOWS\system32\svchost.exe -k netsvcs

Service Name: Áudio do Windows [Running],

Path: C:\WINDOWS\System32\svchost.exe -k netsvcs

Service Name: Auxiliar NetBIOS TCP/IP [Running],

Path: C:\WINDOWS\system32\svchost.exe -k LocalService

Service Name: Avira AntiVir Personal - Free Antivirus Guard [Running],

Path: "C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe"

Service Name: Avira AntiVir Personal - Free Antivirus Scheduler [Running],

Path: "C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe"

Service Name: Cartão inteligente [stopped],

Path: C:\WINDOWS\System32\SCardSvr.exe

Service Name: Central de Segurança [Running],

Path: C:\WINDOWS\System32\svchost.exe -k netsvcs

Service Name: Chamada de procedimento remoto (RPC) [Running],

Path: C:\WINDOWS\system32\svchost -k rpcss

Service Name: Cliente da Web [Running],

Path: C:\WINDOWS\system32\svchost.exe -k LocalService

Service Name: Cliente de rastreamento de link distribuído [Running],

Path: C:\WINDOWS\system32\svchost.exe -k netsvcs

Service Name: Cliente DHCP [Running],

Path: C:\WINDOWS\system32\svchost.exe -k netsvcs

Service Name: Cliente DNS [Running],

Path: C:\WINDOWS\system32\svchost.exe -k NetworkService

Service Name: Compartilhamento remoto da área de trabalho do NetMeeting [stopped],

Path: C:\WINDOWS\system32\mnmsrvc.exe

Service Name: Compatibilidade com 'Troca rápida de usuário' [stopped],

Path: C:\WINDOWS\System32\svchost.exe -k netsvcs

Service Name: Conexões de rede [Running],

Path: C:\WINDOWS\System32\svchost.exe -k netsvcs

Service Name: Configuração Automática com Fio [stopped],

Path: C:\WINDOWS\System32\svchost.exe -k dot3svc

Service Name: Configuração zero sem fio [Running],

Path: C:\WINDOWS\System32\svchost.exe -k netsvcs

Service Name: Coordenador de transações distribuídas [stopped],

Path: C:\WINDOWS\system32\msdtc.exe

Service Name: Cópia de volume em memória [stopped],

Path: C:\WINDOWS\System32\vssvc.exe

Service Name: DDE de rede [stopped],

Path: C:\WINDOWS\system32\netdde.exe

Service Name: Detecção do hardware do shell [Running],

Path: C:\WINDOWS\System32\svchost.exe -k netsvcs

Service Name: DSDM de DDE de rede [stopped],

Path: C:\WINDOWS\system32\netdde.exe

Service Name: Erro ao informar o serviço [stopped],

Path: C:\WINDOWS\System32\svchost.exe -k netsvcs

Service Name: Estação de trabalho [Running],

Path: C:\WINDOWS\system32\svchost.exe -k netsvcs

Service Name: Extensões de driver de instrum. gerenc. do Windows [stopped],

Path: C:\WINDOWS\System32\svchost.exe -k netsvcs

Service Name: Firewall do Windows/Compartilhamento de Conexão com a Internet (ICS) [Running],

Path: C:\WINDOWS\system32\svchost.exe -k netsvcs

Service Name: Fornecedor de suporte de segurança NT LM [stopped],

Path: C:\WINDOWS\system32\lsass.exe

Service Name: Gerenciador de conexão de acesso remoto [Running],

Path: C:\WINDOWS\system32\svchost.exe -k netsvcs

Service Name: Gerenciador de conexão de acesso remoto automático [stopped],

Path: C:\WINDOWS\system32\svchost.exe -k netsvcs

Service Name: Gerenciador de contas de segurança [Running],

Path: C:\WINDOWS\system32\lsass.exe

Service Name: Gerenciador de discos lógicos [Running],

Path: C:\WINDOWS\System32\svchost.exe -k netsvcs

Service Name: Gerenciador de sessão de ajuda de área de trabalho remota [stopped],

Path: C:\WINDOWS\system32\sessmgr.exe

Service Name: Gerenciamento de aplicativo [stopped],

Path: C:\WINDOWS\system32\svchost.exe -k netsvcs

Service Name: Google Updater Service [stopped],

Path: "C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe"

Service Name: Horário do Windows [Running],

Path: C:\WINDOWS\System32\svchost.exe -k netsvcs

Service Name: Host de dispositivo Plug and Play universal [stopped],

Path: C:\WINDOWS\system32\svchost.exe -k LocalService

Service Name: HTTP SSL [Running],

Path: C:\WINDOWS\System32\svchost.exe -k HTTPFilter

Service Name: IMAPI CD-Burning COM Service [stopped],

Path: C:\WINDOWS\system32\imapi.exe

Service Name: Inicializador de Processo de Servidor DCOM [Running],

Path: C:\WINDOWS\system32\svchost -k DcomLaunch

Service Name: Localizador de computadores [stopped],

Path: C:\WINDOWS\system32\svchost.exe -k netsvcs

Service Name: Log de eventos [Running],

Path: C:\WINDOWS\system32\services.exe

Service Name: Logon de rede [stopped],

Path: C:\WINDOWS\system32\lsass.exe

Service Name: Logon secundário [Running],

Path: C:\WINDOWS\System32\svchost.exe -k netsvcs

Service Name: Logs e alertas de desempenho [stopped],

Path: C:\WINDOWS\system32\smlogsvc.exe

Service Name: Mensageiro [stopped],

Path: C:\WINDOWS\system32\svchost.exe -k netsvcs

Service Name: MS Software Shadow Copy Provider [stopped],

Path: C:\WINDOWS\system32\dllhost.exe /Processid:{9169CB9E-DB4A-4DB2-8B69-3F144C800046}

Service Name: Notificação de eventos de sistema [Running],

Path: C:\WINDOWS\system32\svchost.exe -k netsvcs

Service Name: Office Source Engine [stopped],

Path: "C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Source Engine\OSE.EXE"

Service Name: Plug and Play [Running],

Path: C:\WINDOWS\system32\services.exe

Service Name: Portable Media Serial Number Service [stopped],

Path: C:\WINDOWS\System32\svchost.exe -k netsvcs

Service Name: QoS RSVP [stopped],

Path: C:\WINDOWS\system32\rsvp.exe

Service Name: Reconhecimento de local da rede (NLA) [Running],

Path: C:\WINDOWS\system32\svchost.exe -k netsvcs

Service Name: Registro remoto [stopped],

Path: C:\WINDOWS\system32\svchost.exe -k LocalService

Service Name: Roteamento e acesso remoto [stopped],

Path: C:\WINDOWS\system32\svchost.exe -k netsvcs

Service Name: Serviço administrativo do gerenciador de disco lógico [stopped],

Path: C:\WINDOWS\System32\dmadmin.exe /com

Service Name: Serviço de Configuração de Rede [stopped],

Path: C:\WINDOWS\System32\svchost.exe -k netsvcs

Service Name: Serviço de descoberta SSDP [Running],

Path: C:\WINDOWS\system32\svchost.exe -k LocalService

Service Name: Serviço de EAP (Extensible Authentication Protocol) [stopped],

Path: C:\WINDOWS\System32\svchost.exe -k eapsvcs

Service Name: Serviço de Gerenciamento de Certificados e Chaves de Integridade [stopped],

Path: C:\WINDOWS\System32\svchost.exe -k netsvcs

Service Name: Serviço de indexação [stopped],

Path: C:\WINDOWS\system32\cisvc.exe

Service Name: Serviço de restauração do sistema [Running],

Path: C:\WINDOWS\system32\svchost.exe -k netsvcs

Service Name: Serviço de transferência inteligente de plano de fundo [stopped],

Path: C:\WINDOWS\system32\svchost.exe -k netsvcs

Service Name: Serviço 'Gateway de camada de aplicativo' [Running],

Path: C:\WINDOWS\System32\alg.exe

Service Name: Serviços de criptografia [Running],

Path: C:\WINDOWS\system32\svchost.exe -k netsvcs

Service Name: Serviços de terminal [Running],

Path: C:\WINDOWS\System32\svchost -k DComLaunch

Service Name: Serviços IPSEC [Running],

Path: C:\WINDOWS\system32\lsass.exe

Service Name: Servidor [Running],

Path: C:\WINDOWS\system32\svchost.exe -k netsvcs

Service Name: Sistema de alimentação ininterrupta [stopped],

Path: C:\WINDOWS\System32\ups.exe

Service Name: Sistema de eventos COM+ [Running],

Path: C:\WINDOWS\system32\svchost.exe -k netsvcs

Service Name: SNMgrSvc [Running],

Path: "C:\WINDOWS\system32\SnMgrSvc.exe"

Service Name: Spooler de impressão [Running],

Path: C:\WINDOWS\system32\spoolsv.exe

Service Name: Telefonia [Running],

Path: C:\WINDOWS\System32\svchost.exe -k netsvcs

Service Name: Telnet [stopped],

Path: C:\WINDOWS\system32\tlntsvr.exe

Service Name: Temas [Running],

Path: C:\WINDOWS\System32\svchost.exe -k netsvcs

Service Name: Testador de instrumentação de gerenciam. do Windows [Running],

Path: C:\WINDOWS\system32\svchost.exe -k netsvcs

Service Name: Windows Driver Foundation - User-mode Driver Framework [stopped],

Path: C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

Service Name: Windows Installer [stopped],

Path: C:\WINDOWS\system32\msiexec.exe /V

Service Name: Windows Live OneCare Proteção para a Família [Running],

Path: "C:\Arquivos de programas\Windows Live\Proteção para a Família\fsssvc.exe"

Service Name: Windows User Mode Driver Framework [Running],

Path: C:\WINDOWS\system32\wdfmgr.exe

Terminado...

[Silas Martins 0]

Siga as instruções abaixo:

 

Baixe o Killbox

Execute o KillBox,clique em Delete on Reboot.

Copie a lista abaixo:

C:\WINDOWS\system32\FCCTRL4.DLL

C:\WINDOWS\system32\sniperiu.exe

C:\WINDOWS\system32\url(2).dll

C:\Arquivos de programas\Search Settings\kb126\SearchSettings.dll

C:\Arquivos de programas\Search Settings\SearchSettings.exe

 

Vá ao Killbox.E clique em File > Paste from clipboard. Clique em All Files.

 

Pressione "X". Responda "NÃO" à pergunta.

 

Reinicie

o computador em Modo Seguro (após reiniciar aperte a tecla F8 repetidamente até aparecer uma tela preta em DOS e escolha Modo Seguro).

 

Execute o HijackThis, clique em Do a system scan only e selecione as linhas:

R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Arquivos de programas\Search Settings\kb126\SearchSettings.dll

O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Arquivos de programas\Search Settings\kb126\SearchSettings.dll

O4 - HKLM\..\Run: [searchSettings] C:\Arquivos de programas\Search Settings\SearchSettings.exe

Clique em Fix Checked

Feito isso Reinicie em modo normal e gere um novo log do Hijackthis.

 

Aguardo retorno.

[mulher 0]

Fiz oq solicitou esqueci de dizer q a pagina com papel de parede apagou a tela esta preta com icones iguais no lado direito aparece dizendo q o windows é falsificado

 

VALEU abraços aguardo por você.....

 

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 08:44:31, on 6/2/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\WINDOWS\system32\WgaTray.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\WINDOWS\system32\SnAgOS.exe

C:\WINDOWS\system32\SnMgrSvc.exe

C:\WINDOWS\Explorer.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Windows Live\Proteção para a Família\fssui.exe

C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Arquivos de programas\BrOffice.org 2.4\program\soffice.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\Arquivos de programas\BrOffice.org 2.4\program\soffice.BIN

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\wuauclt.exe

C:\DOCUME~1\ADMINI~1\CONFIG~1\Temp\Diretório temporário 6 para HiJackThis.zip\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R3 - URLSearchHook: Barra de Ferramentas do Yahoo! - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Arquivos de programas\AskSBar\SrchAstt\2.bin\A2SRCHAS.DLL

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)

O2 - BHO: Windows Live OneCare Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Arquivos de programas\Windows Live\Proteção para a Família\fssbho.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar1.dll

O3 - Toolbar: Barra de Ferramentas do Yahoo! - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)

O4 - HKLM\..\Run: [fssui] "C:\Arquivos de programas\Windows Live\Proteção para a Família\fssui.exe" -autorun

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background

O4 - Startup: BrOffice.org 2.4.lnk = C:\Arquivos de programas\BrOffice.org 2.4\program\quickstart.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {3C8B9651-4E3E-424D-B51C-54544ABF536B} (CAtmCap Object) - https://ww7.banrisul.com.br/bxz/data/securecontrol2k.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{22A5162A-CF53-40D2-BA7A-746FC3D40C24}: NameServer = 192.168.254.254

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: SNMgrSvc - Open Communications Security S/A - C:\WINDOWS\system32\SnMgrSvc.exe

 

--

End of file - 6749 bytes

[Silas Martins 0]

Log limpo

 

Fiz oq solicitou esqueci de dizer q a pagina com papel de parede apagou a tela esta preta com icones iguais no lado direito aparece dizendo q o windows é falsificado

Isso ocorreu quando, antes ou depois do de você utilizar as ferramentas de remoção?, e outra coisa se lembra de fazer download no site da microsoft?

Aguardo retorno.

[mulher 0]

Ola Silas

Ocorria antes de ficar sem papel de parede, mas agora não abre mais nem mais a pagina do windows apenas aparece uma pagina preta com esse escrito embaixo de falso.... tentei fazer de tudo mas sou muito leiga em relação a isso então.... aguardo retorno....Valeu bom findi

[Silas Martins 0]

Já tentou a restauração do sistema?

Creio que o seu caso seja para uma restauração ou então utilizar o cd do XP para recuperar o S.O

[mulher 0]

Ja tentei restauração, e sobre o cd não possuo qdo comprei o notebook veio instalado mas sem cd tem outra forma....obrigado

[Silas Martins 0]

Seu Windows é original?

[mulher 0]

Ola logo acima lhe disse q aparecia um icone no lado direito dizendo q a copia do windows era pirata.....

[Silas Martins 0]

Esse alerta é do WGA ele pode ser removido, mas isso é contra a lei. Vou tratar aqui somente da desinfecção do pc no mais procure auxilio para o XP em fóruns especializado em Sistemas operacionais.

Siga as instruções abaixo:

Baixe o SDFix e e arquive na sua área de trabalho.

 

*Execute o SDFix.exe[/b] clicando duas vezes sobre ele.

* Permitam-lo para instalar na localização padrão, que é normalmente c: \ SDFix

* Agora, por favor, reinicie o computador em modo de segurança (Reinicie o computador e segure a tecla F8 sem solta-la até que seja disponibilizada a tela onde você opte por modo de segurança)

* Depois de ter arrancado em modo seguro, abra o C: \ SDFix pasta e dê um duplo clique em RunThis.bat para iniciar o script.

* Aperte Y para iniciar a limpeza do processo.

* Ele irá remover qualquer Tróia ou Serviços Secretaria entradas encontradas e, em seguida, pedir-lhe para pressione qualquer tecla para reiniciar.

* Pressione qualquer tecla e ele irá reiniciar o PC.

* Quando o PC reinicia a Fixtool irá correr de novo e completar o processo de remoção exibição terminados em seguida, pressione qualquer tecla para terminar o script e carregar seu desktop ícones.

* Depois de a carregar os ícones desktop SDFix relatório será aberta a tela e também em salvar a pasta SDFix como Report.txt.

*Poste o Report.txt juntamente com novo log do hijackthis gerado em modo normal.

[Mário Monteiro 179]

Tópico Arquivado

 

Como o autor não respondeu por mais de 30 dias, o tópico foi arquivado.

 

Caso você seja o autor do tópico e quer reabrir, envie uma mensagem privada para um moderador da área juntamente com o link para este tópico e explique o motivo da reabertura.