[Arquivado] Iexplore.exe a 100%

allan_aguia · Abril 7, 2009

OLA PESSOAL,, SEMPRE QUE ENTRO NA NET E MUDO DE UMA PAGINA PRA OUTRA O IEXPLORE.EXE FICA EM 100% E SEMPRE QUE RETORNO A UMA PAGINA DIZ QUE O PROGRAMA NAO ESTA RESPONDENDO E TEM QUE SER FINALIZA. JA PASSEI O AVIRA, SPY DOCTOR, COMBOFIX. BANKERFIX,ADWARE-SE, SPYBOOT S/D E MALWAREBYTS.

Logfile of HijackThis v1.99.1

Scan saved at 12:56, on 07-04-2009

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Ahead\InCD\InCDsrv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\AVPersonal\AVGUARD.EXE

C:\Arquivos de programas\AVPersonal\AVWUPSRV.EXE

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\pctspk.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\AVPersonal\AVGNT.EXE

C:\Arquivos de programas\internet explorer\iexplore.exe

C:\Arquivos de programas\MSN Messenger\msnmsgr.exe

C:\Arquivos de programas\MSN Messenger\livecall.exe

C:\Arquivos de programas\MSN Messenger\usnsvc.exe

C:\Documents and Settings\Louise\Meus documentos\instaladores\hijackthis.exe

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Arquivos de programas\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Arquivos de programas\myBabylon_English\tbmyB1.dll

O3 - Toolbar: myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Arquivos de programas\myBabylon_English\tbmyB1.dll

O4 - HKLM\..\Run: [AVGCtrl] C:\Arquivos de programas\AVPersonal\AVGNT.EXE /min

O8 - Extra context menu item: Translate with &Babylon - res://C:\Arquivos de programas\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Arquivos de programas\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Arquivos de programas\Spybot - Search & Destroy\SDHelper.dll

O17 - HKLM\System\CCS\Services\Tcpip\..\{54A72A25-B7B5-4B60-ABE7-1B0E7108A7CF}: NameServer = 172.16.4.22

O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Arquivos de programas\AVPersonal\AVGUARD.EXE

O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Arquivos de programas\AVPersonal\AVWUPSRV.EXE

O23 - Service: Google Updater Service (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Arquivos de programas\Ahead\InCD\InCDsrv.exe

O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - C:\Arquivos de programas\Ahead\InCD\InCDsrv.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Arquivos de programas\Java\jre6\bin\jqs.exe" -service -config "C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)

O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\System32\GameMon.des.exe (file missing)

O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Arquivos de programas\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Arquivos de programas\Spyware Doctor\pctsSvc.exe

O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Unknown owner - C:\Arquivos de programas\Webroot\Spy Sweeper\WRSSSDK.exe (file missing)

ComboFix 09-04-04.01 - Louise 2009-04-05 12:59:23.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1046.18.479.180 [GMT -3:00]

Executando de: c:\documents and settings\Louise\Desktop\ComboFix.exe

* Criado um novo ponto de restauro

ATENÇAO - ESTA MAQUINA NAO TEM O CONSOLE DE RECUPERAÇÃO INSTALADA !!

.

(((((((((((((((( Arquivos/Ficheiros criados de 2009-03-05 to 2009-04-05 ))))))))))))))))))))))))))))

.

2009-03-28 10:43 . 2009-03-28 10:43 <DIR> d-------- c:\arquivos de programas\TeaTimer (Spybot - Search & Destroy)

2009-03-28 10:43 . 2009-03-28 10:43 <DIR> d-------- c:\arquivos de programas\SDHelper (Spybot - Search & Destroy)

2009-03-28 10:43 . 2009-03-28 10:43 <DIR> d-------- c:\arquivos de programas\Misc. Support Library (Spybot - Search & Destroy)

2009-03-28 10:43 . 2009-03-28 10:43 <DIR> d-------- c:\arquivos de programas\File Scanner Library (Spybot - Search & Destroy)

2009-03-27 14:37 . 2009-03-27 14:37 <DIR> d-------- c:\arquivos de programas\Windows Live Safety Center

2009-03-22 13:45 . 2009-03-22 15:21 519 --a------ C:\hpfr3420.xml

2009-03-21 19:11 . 2009-03-21 19:11 <DIR> d-------- c:\windows\Sun

2009-03-19 20:32 . 2009-03-19 20:55 <DIR> d-------- c:\documents and settings\Louise\.receitanet

2009-03-18 14:04 . 2009-03-18 14:04 <DIR> d-------- c:\documents and settings\Louise\Dados de aplicativos\IObit

2009-03-18 14:03 . 2009-03-18 14:03 <DIR> d-------- c:\arquivos de programas\IObit

2009-03-18 14:02 . 2001-08-18 06:36 8,704 --a--c--- c:\windows\system32\dllcache\kbdjpn.dll

2009-03-18 14:02 . 2001-08-18 06:36 8,192 --a--c--- c:\windows\system32\dllcache\kbdkor.dll

2009-03-18 14:02 . 2001-08-17 22:55 6,144 --a--c--- c:\windows\system32\dllcache\kbd106.dll

2009-03-18 14:02 . 2001-08-17 22:55 6,144 --a--c--- c:\windows\system32\dllcache\kbd101c.dll

2009-03-18 14:02 . 2001-08-17 22:55 6,144 --a--c--- c:\windows\system32\dllcache\kbd101b.dll

2009-03-18 14:02 . 2001-08-17 22:55 5,632 --a--c--- c:\windows\system32\dllcache\kbd103.dll

2009-03-14 16:18 . 2009-03-19 20:57 <DIR> d-------- C:\Recnet

2009-03-14 16:18 . 2008-12-29 09:16 128,000 --a------ c:\windows\DesinstWRecnet.EXE

2009-03-14 16:18 . 2008-12-29 09:16 122,880 --a------ c:\windows\DesinstRecnet.exe

2009-03-14 16:18 . 2008-12-29 09:16 5,361 --a------ c:\windows\DesinstWRecnet.ini

2009-03-14 16:18 . 2009-03-14 16:18 129 --a------ c:\windows\REC-NET.INI

2009-03-14 16:12 . 2009-03-14 16:12 <DIR> d-------- C:\Arquivos de Programas RFB

2009-03-14 15:46 . 2009-03-14 15:46 <DIR> d-------- c:\arquivos de programas\Java

2009-03-14 15:46 . 2009-03-14 15:46 73,728 --a------ c:\windows\system32\javacpl.cpl

2009-03-14 15:28 . 2009-03-14 15:46 410,984 --a------ c:\windows\system32\deploytk.dll

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-04-05 15:12 196 ----a-w c:\windows\system32\drivers\ALCICH.DAT

2009-04-04 22:18 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\Avg7

2009-04-03 21:24 --------- d---a-w c:\documents and settings\All Users\Dados de aplicativos\TEMP

2009-04-03 15:59 --------- d-----w c:\arquivos de programas\Spyware Doctor

2009-04-03 11:30 --------- d-----w c:\arquivos de programas\AVPersonal

2009-03-28 14:57 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\Spybot - Search & Destroy

2009-03-28 14:00 --------- d-----w c:\arquivos de programas\Spybot - Search & Destroy

2009-03-27 19:07 --------- d-----w c:\arquivos de programas\Steam

2009-03-26 15:20 --------- d-----w c:\arquivos de programas\Counter-Strike

2009-03-01 05:33 --------- d-----w c:\arquivos de programas\Anti Trojan Elite

2009-02-28 03:05 --------- d-----w c:\documents and settings\Louise\Dados de aplicativos\Malwarebytes

2009-02-28 03:04 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes

2009-02-28 03:04 --------- d-----w c:\arquivos de programas\Malwarebytes' Anti-Malware

2009-02-16 00:32 --------- d-----w c:\arquivos de programas\Google

2009-02-15 00:09 65,912 ----a-w C:\nerodigital.bin

2009-02-13 11:41 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\DriverCure

2009-02-13 11:38 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\ParetoLogic

2009-02-13 01:35 --------- d-----w c:\documents and settings\Louise\Dados de aplicativos\Flap Pure

2009-02-12 15:47 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\Atom Idle Dash Bend

2009-02-12 15:43 --------- d-----w c:\arquivos de programas\MSN Messenger

2009-02-12 15:43 --------- d-----w c:\arquivos de programas\Messenger Plus! Live

2009-02-11 13:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-02-11 13:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-02-10 22:37 --------- d-----w c:\arquivos de programas\myBabylon_English

2009-01-27 16:07 11,955,079 ------w C:\AVG7QT.DAT

2009-01-20 18:25 22 ----a-w c:\documents and settings\Louise\xrt_collect.zip

2009-01-05 22:33 3,751,995 ----a-w c:\windows\system32\GPhotos.scr

2008-09-05 15:00 0 --sh--w c:\arquivos de programas\megatron.ini

2008-04-16 19:47 488 ---ha-w c:\documents and settings\Louise\hpothb07.dat

2005-10-25 02:45 81 ----a-w c:\documents and settings\Louise\delsmltr.bat

2005-04-12 14:14 0 ---ha-w c:\documents and settings\Louise\Dados de aplicativos\hpothb07.dat

2002-12-04 17:45 751,232 ----a-w c:\windows\inf\DRIVERS\VIDEO\SISGRV.DLL

2002-12-02 19:39 831,488 ----a-w c:\windows\inf\DRIVERS\VIDEO\SISGL.DLL

2002-12-02 18:33 250,368 ----a-w c:\windows\inf\DRIVERS\VIDEO\SISGRP.SYS

2002-11-13 21:17 6,598 ----a-w c:\windows\inf\DRIVERS\VIDEO\INSTFUNC.DLL

2002-11-13 18:26 172,032 ----a-w c:\windows\inf\DRIVERS\VIDEO\SISINST.DLL

2002-11-13 18:11 221,184 ----a-w c:\windows\inf\DRIVERS\VIDEO\SISPARSE.DLL

2002-11-13 18:09 98,304 ----a-w c:\windows\inf\DRIVERS\VIDEO\SISAPCOM.DLL

2002-11-07 16:38 370,560 ----a-w c:\windows\inf\DRIVERS\VIDEO\S3GNB.DLL

2002-11-07 16:38 159,104 ----a-w c:\windows\inf\DRIVERS\VIDEO\S3GNBM.SYS

2002-11-05 09:02 335,872 ----a-w c:\windows\inf\DRIVERS\VIDEO\S3DISPLY.DLL

2002-10-23 03:58 299,008 ----a-w c:\windows\inf\DRIVERS\VIDEO\S3GAMMA2.DLL

2002-10-01 08:08 188,416 ----a-w c:\windows\inf\DRIVERS\VIDEO\S3INFO2.DLL

2002-08-09 13:12 770,048 ----a-w c:\windows\inf\DRIVERS\VIDEO\NBICDNT.DLL

2002-07-11 02:39 32,256 ----a-w c:\windows\inf\DRIVERS\LAN\SISNIC.SYS

2002-05-29 04:06 315,392 ----a-w c:\windows\inf\DRIVERS\VIDEO\S3OVRLAY.DLL

2002-04-26 21:27 49,152 ----a-w c:\windows\inf\DRIVERS\VIDEO\SIS740.BIN

2002-04-26 21:27 49,152 ----a-w c:\windows\inf\DRIVERS\VIDEO\SIS650.BIN

2002-03-12 06:52 69,690 ----a-w c:\windows\inf\DRIVERS\VIDEO\S3UNINST.EXE

2002-02-13 14:27 166,419 ----a-w c:\windows\inf\DRIVERS\MODEM\MSP3885U\HSFHWBS2.SYS

2002-02-13 14:26 1,171,584 ----a-w c:\windows\inf\DRIVERS\MODEM\MSP3885U\HSF_DP.SYS

2002-02-13 14:20 594,032 ----a-w c:\windows\inf\DRIVERS\MODEM\MSP3885U\HSF_CNXT.SYS

2002-02-08 00:00 266,240 ----a-w c:\windows\inf\DRIVERS\MODEM\MSP3885U\HXFSETUP.EXE

2001-12-25 13:23 12,074 ----a-w c:\windows\inf\DRIVERS\MODEM\MSP3885U\HSFINST.DLL

2001-10-22 17:46 9,855 ----a-w c:\windows\inf\DRIVERS\MODEM\MSP3885U\MDMXSDK.SYS

2001-10-22 17:37 57,344 ----a-w c:\windows\inf\DRIVERS\MODEM\MSP3885U\MDMXSDK.DLL

2001-09-19 07:21 285,533 ----a-w c:\windows\inf\DRIVERS\SOM\ALCXWDM.SYS

2001-08-07 13:53 37,376 ----a-w c:\windows\inf\DRIVERS\LAN\UNINST.EXE

2001-05-29 09:02 124,416 ----a-w c:\windows\inf\DRIVERS\SOM\SOUNDMAN.EXE

2001-02-15 08:28 28,160 ----a-w c:\windows\inf\DRIVERS\SOM\ALDAEMON.EXE

1999-02-17 05:35 60,416 ----a-w c:\windows\inf\DRIVERS\VIDEO\SETUP.EXE

1998-01-28 08:15 11,264 ----a-w c:\windows\inf\DRIVERS\VIDEO\SETUPDIR\0007\_SETUP.DLL

1998-01-28 08:07 8,704 ----a-w c:\windows\inf\DRIVERS\VIDEO\_ISDEL.EXE

1998-01-28 06:20 11,264 ----a-w c:\windows\inf\DRIVERS\VIDEO\SETUPDIR\001D\_SETUP.DLL

1998-01-24 08:40 11,264 ----a-w c:\windows\inf\DRIVERS\VIDEO\SETUPDIR\0009\_SETUP.DLL

1998-01-24 08:32 11,264 ----a-w c:\windows\inf\DRIVERS\VIDEO\SETUPDIR\0804\_SETUP.DLL

1998-01-24 08:32 11,264 ----a-w c:\windows\inf\DRIVERS\VIDEO\SETUPDIR\0404\_SETUP.DLL

1998-01-24 08:30 11,776 ----a-w c:\windows\inf\DRIVERS\VIDEO\SETUPDIR\001E\_SETUP.DLL

1998-01-24 08:26 11,776 ----a-w c:\windows\inf\DRIVERS\VIDEO\SETUPDIR\0019\_SETUP.DLL

1998-01-24 08:26 11,776 ----a-w c:\windows\inf\DRIVERS\VIDEO\SETUPDIR\0012\_SETUP.DLL

1998-01-24 06:49 11,776 ----a-w c:\windows\inf\DRIVERS\VIDEO\SETUPDIR\0011\_SETUP.DLL

1998-01-23 13:08 11,776 ----a-w c:\windows\inf\DRIVERS\VIDEO\SETUPDIR\000A\_SETUP.DLL

1998-01-23 13:07 11,776 ----a-w c:\windows\inf\DRIVERS\VIDEO\SETUPDIR\0010\_SETUP.DLL

1998-01-23 13:07 11,264 ----a-w c:\windows\inf\DRIVERS\VIDEO\SETUPDIR\0416\_SETUP.DLL

1998-01-23 13:07 11,264 ----a-w c:\windows\inf\DRIVERS\VIDEO\SETUPDIR\0014\_SETUP.DLL

1998-01-23 13:06 11,264 ----a-w c:\windows\inf\DRIVERS\VIDEO\SETUPDIR\040C\_SETUP.DLL

1998-01-23 13:06 11,264 ----a-w c:\windows\inf\DRIVERS\VIDEO\SETUPDIR\0013\_SETUP.DLL

1998-01-23 13:06 11,264 ----a-w c:\windows\inf\DRIVERS\VIDEO\SETUPDIR\000B\_SETUP.DLL

1998-01-23 13:05 11,264 ----a-w c:\windows\inf\DRIVERS\VIDEO\SETUPDIR\0006\_SETUP.DLL

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}]

2009-03-24 22:21 1883672 --a------ c:\arquivos de programas\myBabylon_English\tbmyB1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}"= "c:\arquivos de programas\myBabylon_English\tbmyB1.dll" [2009-03-24 1883672]

[HKEY_CLASSES_ROOT\clsid\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{B2E293EE-FD7E-4C71-A714-5F4750D8D7B7}"= "c:\arquivos de programas\myBabylon_English\tbmyB1.dll" [2009-03-24 1883672]

[HKEY_CLASSES_ROOT\clsid\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AVGCtrl"="c:\arquivos de programas\AVPersonal\AVGNT.EXE" [2004-11-08 127016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2002-09-11 13312]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^avg.exe]

path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\avg.exe

backup=c:\windows\pss\avg.exeCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Discador Oi Internet.lnk]

path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\Discador Oi Internet.lnk

backup=c:\windows\pss\Discador Oi Internet.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^hp psc 1000 series.lnk]

path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\hp psc 1000 series.lnk

backup=c:\windows\pss\hp psc 1000 series.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^hpoddt01.exe.lnk]

path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\hpoddt01.exe.lnk

backup=c:\windows\pss\hpoddt01.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^JVM0.exe]

path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\JVM0.exe

backup=c:\windows\pss\JVM0.exeCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^MyWebSearch Email Plugin.lnk]

path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\MyWebSearch Email Plugin.lnk

backup=c:\windows\pss\MyWebSearch Email Plugin.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Windows32.exe]

path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\Windows32.exe

backup=c:\windows\pss\Windows32.exeCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^winexec32.exe]

path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\winexec32.exe

backup=c:\windows\pss\winexec32.exeCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Louise^Menu Iniciar^Programas^Inicializar^MyWebSearch Email Plugin.lnk]

path=c:\documents and settings\Louise\Menu Iniciar\Programas\Inicializar\MyWebSearch Email Plugin.lnk

backup=c:\windows\pss\MyWebSearch Email Plugin.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVSCHED32]

--a------ 2004-11-19 12:04 110632 c:\arquivos de programas\AVPersonal\AVSCHED32.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Babylon Client]

--a------ 2008-12-18 16:32 3961064 c:\arquivos de programas\Babylon\Babylon-Pro\Babylon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]

--a------ 2002-09-11 09:00 13312 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dash bend meta balm]

--a------ 2008-09-12 13:50 1668096 c:\documents and settings\All Users\Dados de aplicativos\Atom Idle Dash Bend\INTERNET LITE.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dllhost]

--a------ 2008-09-05 12:00 1171968 c:\windows\system32\wscntfx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]

--------- 2004-07-16 09:50 1409136 c:\arquivos de programas\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISTray]

--a------ 2008-08-25 11:36 1168264 c:\arquivos de programas\Spyware Doctor\pctsTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Monitor]

--a------ 2006-11-03 11:01 319488 c:\windows\PixArt\Pac207\Monitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

--a------ 2002-04-11 06:36 1458448 c:\arquivos de programas\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnappau]

--a------ 2004-08-13 16:41 86016 c:\arquivos de programas\MSN Apps\Updater\01.02.3000.1001\pt-br\msnappau.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]

--a------ 2007-01-19 11:54 5674352 c:\arquivos de programas\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]

--------- 2004-07-26 19:14 1867776 c:\arquivos de programas\Ahead\Nero BackItUp\NBJ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

--a------ 2001-07-09 11:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PS Assistant]

--a------ 2004-09-30 16:39 249856 c:\arquivos de programas\Photoshop Interface Assistant\Photoshop Interface Assistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]

-ra------ 2008-06-14 18:28 26992424 c:\arquivos de programas\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]

-rahs---- 2009-01-26 15:31 2144088 c:\arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper]

--a------ 2005-10-27 15:41 3402240 c:\arquivos de programas\Webroot\Spy Sweeper\SpySweeper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]

--a------ 2009-03-27 16:08 1410296 c:\arquivos de programas\Steam\steam 2\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

--a------ 2009-03-14 15:46 148888 c:\arquivos de programas\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

--a------ 2008-06-24 11:20 171448 c:\arquivos de programas\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\explorer.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"28579:TCP"= 28579:TCP:port

"15438:TCP"= 15438:TCP:port

R0 SSI;SSI;c:\windows\system32\drivers\ssi.sys [2005-10-30 78336]

R2 AVWUpSrv;AntiVir Update;c:\arquivos de programas\AVPersonal\AVWUPSRV.EXE [2008-05-01 36864]

R3 avgntdd;avgntdd;c:\arquivos de programas\AVPersonal\AVGNTDD.SYS [2004-12-10 32560]

R3 LNIC;LG LNIC-10/100S Series Ethernet Adapter;c:\windows\system32\drivers\LNIC.sys [2004-03-19 38656]

S0 TfFsMon;TfFsMon;c:\windows\System32\drivers\TfFsMon.sys --> c:\windows\System32\drivers\TfFsMon.sys [?]

S0 TfSysMon;TfSysMon;c:\windows\System32\drivers\TfSysMon.sys --> c:\windows\System32\drivers\TfSysMon.sys [?]

S1 PLUG;Driver do GB; [x]

S3 ATE_PROCMON;ATE_PROCMON;\??\c:\arquivos de programas\Anti Trojan Elite\ATEPMon.sys --> c:\arquivos de programas\Anti Trojan Elite\ATEPMon.sys [?]

S3 ddsxeiservice;ddsxeiservice2;\??\c:\arquivos de programas\sXe Injected\ddsxei.sys --> c:\arquivos de programas\sXe Injected\ddsxei.sys [?]

S3 npggsvc;nProtect GameGuard Service;c:\windows\System32\GameMon.des -service --> c:\windows\System32\GameMon.des -service [?]

S3 PAC207;Dlink DSB-C120;c:\windows\system32\drivers\PFC027.SYS [2006-11-20 506112]

S3 sdAuxService;PC Tools Auxiliary Service;c:\arquivos de programas\Spyware Doctor\pctsAuxs.exe [2009-01-20 356920]

S3 SNPP106;PC Camera (6029 CIF);c:\windows\system32\drivers\snpp106.sys [2006-04-09 227200]

S3 TfNetMon;TfNetMon;\??\c:\windows\System32\drivers\TfNetMon.sys --> c:\windows\System32\drivers\TfNetMon.sys [?]

S4 Integrated Windows Authentication;Integrated Windows Authentication;"c:\arquivos de programas\Arquivos comuns\System\MSIWA32.exe" --> c:\arquivos de programas\Arquivos comuns\System\MSIWA32.exe [?]

S4 ThreatFire;ThreatFire;c:\arquivos de programas\ThreatFire\TFService.exe service --> c:\arquivos de programas\ThreatFire\TFService.exe service [?]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a6ed591f-37e6-11d9-91ce-806d6172696f}]

\shell\play\command - "c:\arquivos de programas\Ahead\NeroMediaPlayer\NeroMediaPlayer.exe" %1

.

Conteúdo da pasta 'Tarefas Agendadas'

2009-04-05 c:\windows\Tasks\A765273691E2A3A2.job

- c:\docume~1\louise\dadosd~1\flappu~1\Barb software free.exe [2009-02-12 12:49]

2005-02-19 c:\windows\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1100704202.job

- c:\arquivos de programas\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-05 23:52]

2009-04-04 c:\windows\Tasks\ParetoLogic Update Version2.job

- c:\arquivos de programas\Arquivos comuns\ParetoLogic\UUS2\Pareto_Update.exe []

2009-03-23 c:\windows\Tasks\SmartDefrag.job

- c:\arquivos de programas\IObit\IObit SmartDefrag\IObit SmartDefrag.exe [2009-02-13 18:15]

2009-03-23 c:\windows\Tasks\SmartDefrag.job

- c:\arquivos de programas\IObit\IObit SmartDefrag\ [2009-03-18 14:04]

.

------- Scan Suplementar -------

.

uStart Page = hxxp://www.google.com/

mWindow Title = Microsoft Internet Explorer

uInternet Connection Wizard,ShellNext = iexplore

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Translate with &Babylon - c:\arquivos de programas\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm

TCP: {54A72A25-B7B5-4B60-ABE7-1B0E7108A7CF} = 172.16.4.22

Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\arquiv~1\DAP\dapie.dll

Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\arquiv~1\DAP\dapie.dll

Name-Space Handler: HTTPS\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\arquiv~1\DAP\dapie.dll

DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-04-05 13:06:56

Windows 5.1.2600 Service Pack 1 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet004\Services\npggsvc]

"ImagePath"="c:\windows\System32\GameMon.des -service"

.

--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'winlogon.exe'(448)

c:\windows\System32\ODBC32.dll

- - - - - - - > 'lsass.exe'(504)

c:\windows\System32\dssenh.dll

.

Tempo para conclusão: 2009-04-05 13:13:34

ComboFix-quarantined-files.txt 2009-04-05 16:12:19

ComboFix2.txt 2009-03-26 14:40:21

ComboFix3.txt 2009-03-10 15:49:25

ComboFix4.txt 2009-03-01 18:30:18

ComboFix5.txt 2009-04-05 15:58:29

Pré-execução: 7.030.693.888 bytes disponíveis

Pós execução: 7,263,109,120 bytes disponíveis

282

DigRam · Abril 8, 2009

Boa Noite! allan_aguia

<@> Baixe: < LopS&D >

<@> Salve-o no Disco Local-C!

<@> Instale o programa e clique em: LopSD.cmd

<@> Na janela que abrir,aperte o "p" --> Aperte Enter.

<@> Em outra janela,aperte a opção 2 --> Aperte Enter --> Aguarde!

<@> Terminando,salve e poste o relatório. ( C:\Lop SD\LopR_1.txt )

<@> Poste,também,HijackThis atualizado.

Abraços!

allan_aguia · Abril 8, 2009

segue lop s&d

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 1

X86-based PC ( Uniprocessor Free : Intel® Celeron® CPU 2.00GHz )

BIOS : )Phoenix - Award WorkstationBIOS v6.00PG

USER : Louise ( Administrator )

BOOT : Normal boot

A:\ (USB)

C:\ (Local Disk) - NTFS - Total:37 Go (Free:7 Go)

D:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )

Option : [2] ( 08-04-2009|10:03 )

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

--------------------\\ Lista de pastas em DADOSD~1

[21-08-2005|05:06] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Ahead

[14-10-2007|02:51] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Apple Computer

[08-04-2009|09:03] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Avg7

[01-05-2008|10:06] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Avira

[31-01-2009|08:51] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Babylon

[13-02-2009|08:41] C:\DOCUME~1\ALLUSE~1\DADOSD~1\DriverCure

[13-02-2008|03:12] C:\DOCUME~1\ALLUSE~1\DADOSD~1\DVD Shrink

[20-09-2006|08:06] C:\DOCUME~1\ALLUSE~1\DADOSD~1\GbPlugin

[24-06-2008|11:20] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Google

[28-01-2009|09:25] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Grisoft

[28-02-2009|12:04] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Malwarebytes

[15-09-2006|11:43] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Messenger Plus!

[24-12-2007|11:08] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Microsoft

[17-11-2004|07:08] C:\DOCUME~1\ALLUSE~1\DADOSD~1\MSN6

[13-02-2008|04:12] C:\DOCUME~1\ALLUSE~1\DADOSD~1\NCH Swift Sound

[13-02-2009|08:38] C:\DOCUME~1\ALLUSE~1\DADOSD~1\ParetoLogic

[12-09-2008|10:44] C:\DOCUME~1\ALLUSE~1\DADOSD~1\PC Tools

[24-06-2008|11:17] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Skype

[07-04-2009|02:26] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Spybot - Search & Destroy

[06-04-2009|11:09] C:\DOCUME~1\ALLUSE~1\DADOSD~1\TEMP

[08-03-2007|05:09] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Windows Genuine Advantage

[16-11-2004|03:07] C:\DOCUME~1\DEFAUL~1\DADOSD~1\Identities

[16-11-2004|03:03] C:\DOCUME~1\DEFAUL~1\DADOSD~1\Microsoft

[18-01-2007|04:13] C:\DOCUME~1\LOCALS~1\DADOSD~1\AVG7

[11-12-2006|08:56] C:\DOCUME~1\LOCALS~1\DADOSD~1\Help

[23-02-2007|06:09] C:\DOCUME~1\LOCALS~1\DADOSD~1\Macromedia

[08-04-2009|09:04] C:\DOCUME~1\LOCALS~1\DADOSD~1\Microsoft

[30-10-2005|12:57] C:\DOCUME~1\LOCALS~1\DADOSD~1\Webroot

[16-11-2004|03:14] C:\DOCUME~1\Louise\DADOSD~1\Adobe

[21-08-2005|10:11] C:\DOCUME~1\Louise\DADOSD~1\Ahead

[05-08-2008|03:16] C:\DOCUME~1\Louise\DADOSD~1\ArcSoft

[28-01-2009|09:21] C:\DOCUME~1\Louise\DADOSD~1\AVG7

[31-12-2008|10:12] C:\DOCUME~1\Louise\DADOSD~1\Babylon

[24-06-2008|01:42] C:\DOCUME~1\Louise\DADOSD~1\Google

[21-12-2004|12:35] C:\DOCUME~1\Louise\DADOSD~1\Help

[17-11-2004|12:11] C:\DOCUME~1\Louise\DADOSD~1\Hewlett-Packard

[16-11-2004|03:07] C:\DOCUME~1\Louise\DADOSD~1\Identities

[16-11-2004|03:14] C:\DOCUME~1\Louise\DADOSD~1\InterTrust

[18-03-2009|02:04] C:\DOCUME~1\Louise\DADOSD~1\IObit

[18-11-2004|06:14] C:\DOCUME~1\Louise\DADOSD~1\Kazaa Lite

[24-12-2007|11:08] C:\DOCUME~1\Louise\DADOSD~1\Lavasoft

[15-01-2007|10:19] C:\DOCUME~1\Louise\DADOSD~1\Macromedia

[28-02-2009|12:05] C:\DOCUME~1\Louise\DADOSD~1\Malwarebytes

[22-11-2004|05:59] C:\DOCUME~1\Louise\DADOSD~1\MGI

[08-04-2009|09:04] C:\DOCUME~1\Louise\DADOSD~1\Microsoft

[23-10-2006|11:45] C:\DOCUME~1\Louise\DADOSD~1\MSN6

[20-01-2009|12:22] C:\DOCUME~1\Louise\DADOSD~1\PC Tools

[20-07-2006|12:33] C:\DOCUME~1\Louise\DADOSD~1\RapidGet

[14-11-2008|09:33] C:\DOCUME~1\Louise\DADOSD~1\Skype

[14-11-2008|09:28] C:\DOCUME~1\Louise\DADOSD~1\skypePM

[26-08-2006|09:35] C:\DOCUME~1\Louise\DADOSD~1\Sony Corporation

[14-03-2009|03:14] C:\DOCUME~1\Louise\DADOSD~1\Sun

[22-01-2009|09:29] C:\DOCUME~1\Louise\DADOSD~1\Uniblue

[30-10-2005|12:56] C:\DOCUME~1\Louise\DADOSD~1\Webroot

[04-04-2009|07:19] C:\DOCUME~1\NETWOR~1\DADOSD~1\Microsoft

--------------------\\ Tarefas Agendadas na pasta C:\WINDOWS\Tasks

[05-04-2009 10:49][--a------] C:\WINDOWS\tasks\SmartDefrag.job

[07-04-2009 12:33][--a------] C:\WINDOWS\tasks\ParetoLogic Update Version2.job

[12-04-2005 11:18][--ah-----] C:\WINDOWS\tasks\hpothb07.tif

[12-04-2005 11:18][--ah-----] C:\WINDOWS\tasks\hpothb07.dat

[19-02-2005 01:13][--a------] C:\WINDOWS\tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1100704202.job

[08-04-2009 09:00][--ah-----] C:\WINDOWS\tasks\SA.DAT

[11-09-2002 09:00][---h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Lista de pastas em C:\Arquivos de programas

[13-05-2006|12:25] C:\Arquivos de programas\7-Zip

[16-11-2004|03:14] C:\Arquivos de programas\Adobe

[21-08-2005|05:14] C:\Arquivos de programas\Ahead

[01-03-2009|02:33] C:\Arquivos de programas\Anti Trojan Elite

[08-04-2008|11:38] C:\Arquivos de programas\ArcSoft

[05-04-2009|01:01] C:\Arquivos de programas\Arquivos comuns

[20-04-2007|06:27] C:\Arquivos de programas\AskPBar

[07-04-2009|12:39] C:\Arquivos de programas\AVPersonal

[13-02-2008|04:32] C:\Arquivos de programas\AVSMedia

[30-12-2008|06:40] C:\Arquivos de programas\Babylon

[13-02-2008|04:06] C:\Arquivos de programas\BurnRight! CD & DVD

[07-04-2009|02:17] C:\Arquivos de programas\CCleaner

[30-12-2008|06:40] C:\Arquivos de programas\Conduit

[26-03-2009|12:20] C:\Arquivos de programas\Counter-Strike

[26-10-2007|05:22] C:\Arquivos de programas\DAP

[20-04-2005|09:55] C:\Arquivos de programas\Digital

[20-04-2005|09:58] C:\Arquivos de programas\directx

[08-04-2008|11:33] C:\Arquivos de programas\Dlink DSB-C120

[28-03-2009|10:43] C:\Arquivos de programas\File Scanner Library (Spybot - Search & Destroy)

[15-02-2009|09:32] C:\Arquivos de programas\Google

[27-01-2009|01:01] C:\Arquivos de programas\Grisoft

[13-06-2008|06:30] C:\Arquivos de programas\Half-life

[19-05-2006|10:31] C:\Arquivos de programas\hardcore

[17-11-2004|12:06] C:\Arquivos de programas\Hewlett-Packard

[08-04-2009|09:22] C:\Arquivos de programas\InstallShield Installation Information

[16-11-2004|03:07] C:\Arquivos de programas\Internet Explorer

[18-03-2009|02:03] C:\Arquivos de programas\IObit

[24-10-2007|09:42] C:\Arquivos de programas\iRiver

[14-03-2009|03:46] C:\Arquivos de programas\Java

[24-12-2007|11:08] C:\Arquivos de programas\Lavasoft

[28-02-2009|12:04] C:\Arquivos de programas\Malwarebytes' Anti-Malware

[26-05-2006|10:09] C:\Arquivos de programas\Messenger

[12-02-2009|12:43] C:\Arquivos de programas\Messenger Plus! Live

[17-11-2004|09:46] C:\Arquivos de programas\MGI

[16-11-2004|03:07] C:\Arquivos de programas\microsoft frontpage

[26-10-2007|06:09] C:\Arquivos de programas\Microsoft Office

[28-03-2009|10:43] C:\Arquivos de programas\Misc. Support Library (Spybot - Search & Destroy)

[16-07-2007|03:02] C:\Arquivos de programas\Motorola

[01-05-2006|11:21] C:\Arquivos de programas\Movie Maker

[26-10-2007|09:31] C:\Arquivos de programas\MSECache

[30-01-2005|11:59] C:\Arquivos de programas\MSN

[16-01-2005|12:53] C:\Arquivos de programas\MSN Apps

[16-11-2004|02:58] C:\Arquivos de programas\MSN Gaming Zone

[12-02-2009|12:43] C:\Arquivos de programas\MSN Messenger

[16-11-2004|03:01] C:\Arquivos de programas\NetMeeting

[08-04-2009|09:13] C:\Arquivos de programas\NewTech Infosystems

[16-11-2004|03:01] C:\Arquivos de programas\Outlook Express

[20-08-2007|09:56] C:\Arquivos de programas\Phoenxsoftware

[17-11-2004|12:45] C:\Arquivos de programas\Photoshop Interface Assistant

[31-10-2008|09:10] C:\Arquivos de programas\plugin

[26-10-2007|08:35] C:\Arquivos de programas\PowerPoint Viewer

[02-12-2004|05:09] C:\Arquivos de programas\PresenterSoft MediaEasy

[13-10-2007|05:58] C:\Arquivos de programas\QuickTime

[28-03-2009|10:43] C:\Arquivos de programas\SDHelper (Spybot - Search & Destroy)

[16-11-2004|03:01] C:\Arquivos de programas\Serviços on-line

[24-06-2008|11:17] C:\Arquivos de programas\Skype

[26-08-2006|09:31] C:\Arquivos de programas\Sony

[06-08-2008|08:20] C:\Arquivos de programas\Specialty Sensor Technologies

[28-03-2009|11:00] C:\Arquivos de programas\Spybot - Search & Destroy

[03-04-2009|12:59] C:\Arquivos de programas\Spyware Doctor

[27-03-2009|04:07] C:\Arquivos de programas\Steam

[07-05-2008|08:23] C:\Arquivos de programas\Tales Of Pirates Online

[28-03-2009|10:43] C:\Arquivos de programas\TeaTimer (Spybot - Search & Destroy)

[17-11-2004|12:27] C:\Arquivos de programas\Trend Micro

[16-11-2004|03:19] C:\Arquivos de programas\Uninstall Information

[08-06-2008|12:26] C:\Arquivos de programas\Unity

[23-01-2007|06:50] C:\Arquivos de programas\WarRock

[30-10-2005|12:56] C:\Arquivos de programas\Webroot

[15-11-2008|09:17] C:\Arquivos de programas\Webzen

[22-03-2008|04:38] C:\Arquivos de programas\Windows Live

[27-03-2009|02:37] C:\Arquivos de programas\Windows Live Safety Center

[26-05-2006|10:09] C:\Arquivos de programas\Windows Media Player

[16-11-2004|02:58] C:\Arquivos de programas\Windows NT

[28-12-2004|07:58] C:\Arquivos de programas\WindowsUpdate

[07-10-2007|06:53] C:\Arquivos de programas\WinRAR

[16-11-2004|03:07] C:\Arquivos de programas\xerox

[13-10-2007|05:58] C:\Arquivos de programas\Xilisoft

[02-12-2004|11:35] C:\Arquivos de programas\Yahoo!

--------------------\\ Lista de pastas em C:\Arquivos de programas\Arquivos comuns

[16-11-2004|07:17] C:\Arquivos de programas\Arquivos comuns\Adobe

[21-08-2005|05:06] C:\Arquivos de programas\Arquivos comuns\Ahead

[08-04-2008|11:41] C:\Arquivos de programas\Arquivos comuns\ArcSoft

[13-02-2008|04:32] C:\Arquivos de programas\Arquivos comuns\AVSMedia

[17-11-2004|12:04] C:\Arquivos de programas\Arquivos comuns\Hewlett-Packard

[26-08-2006|09:31] C:\Arquivos de programas\Arquivos comuns\InstallShield

[22-11-2004|05:59] C:\Arquivos de programas\Arquivos comuns\MGI Shared

[26-10-2007|05:58] C:\Arquivos de programas\Arquivos comuns\Microsoft Shared

[16-11-2004|03:00] C:\Arquivos de programas\Arquivos comuns\MSSoap

[16-11-2004|03:52] C:\Arquivos de programas\Arquivos comuns\ODBC

[08-04-2008|11:33] C:\Arquivos de programas\Arquivos comuns\PAC207

[08-04-2008|11:33] C:\Arquivos de programas\Arquivos comuns\PXIINST207

[08-04-2008|11:33] C:\Arquivos de programas\Arquivos comuns\PXIINST64207

[01-05-2006|11:22] C:\Arquivos de programas\Arquivos comuns\Serviços

[24-06-2008|11:17] C:\Arquivos de programas\Arquivos comuns\Skype

[09-04-2006|01:03] C:\Arquivos de programas\Arquivos comuns\snpp106

[16-11-2004|03:52] C:\Arquivos de programas\Arquivos comuns\SpeechEngines

[07-07-2008|05:03] C:\Arquivos de programas\Arquivos comuns\System

--------------------\\ Process

( 26 Processes )

... OK !

--------------------\\ Procura pelo S_Lop

Não foram encontradas pastas com o Lop!

--------------------\\ Procura por Arquivos/Ficheiros e pastas do Lop

Não foram encontradas pastas com o Lop!

--------------------\\ Procura no Registro

..... OK !

--------------------\\ Verificando o Arquivos/Ficheiros Hosts

Arquivos/Ficheiros Hosts LIMPO

--------------------\\ Procurando Arquivos/Ficheiros ocultos com o Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-04-08 10:05:36

Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden files: 427

--------------------\\ Procurando por outras infecções

Não foram encontradas outras infecções.

[F:153][D:4]-> C:\DOCUME~1\Louise\CONFIG~1\Temp

[F:84][D:0]-> C:\DOCUME~1\Louise\Cookies

[F:3331][D:6]-> C:\DOCUME~1\Louise\CONFIG~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 08-04-2009|10:09 - Option : [2]

--------------------\\ Verificação completa em 10:09:54

hijack

Logfile of HijackThis v1.99.1

Scan saved at 10:16, on 08-04-2009

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Ahead\InCD\InCDsrv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\AVPersonal\AVGUARD.EXE

C:\Arquivos de programas\AVPersonal\AVWUPSRV.EXE

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\pctspk.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\AVPersonal\AVGNT.EXE

C:\Arquivos de programas\MSN Messenger\msnmsgr.exe

C:\Arquivos de programas\MSN Messenger\livecall.exe

C:\Arquivos de programas\MSN Messenger\usnsvc.exe

C:\ARQUIV~1\DAP\DAP.EXE

C:\WINDOWS\system32\NOTEPAD.EXE