[Resolvido!] PC com olhrwef

Victorine · Abril 11, 2009

Pessoal, mais uma vez necessito da ajuda de vocês!!!

É o seguinte, após instalar o Windows XP no meu computador, e depois de ter passado um bom tempo para limpar os vírus do mesmo, o qual só foi possível com uma formatação (coisa braba!!!), pensava que meu pc estaca livre das pragas virtuais. Só que, quando eu fui no msconfig para desabilitar alguns itens de inicialização, tinha um processo sendo iniciado com o nome olhrwef.exe. Como eu não sabia o que era, fucei na net e descobri que se trata de um malware. Então, gostaria que alguém me ajudasse a retira-lo do meu pc. Desde já agradeço pela ajuda e atenção.

P.S.: Abaixo está o log do HJT.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 00:17:35, on 11/4/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Arquivos comuns\G DATA\AVKProxy\AVKProxy.exe

C:\Arquivos de programas\G DATA\AntiVirus\AVK\AVKService.exe

C:\Arquivos de programas\G DATA\AntiVirus\AVK\AVKWCtl.exe

C:\WINDOWS\system32\slserv.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

C:\Arquivos de programas\G DATA\AntiVirus\AVKTray\AVKTray.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\RALINK\Common\RaUI.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/

O2 - BHO: G DATA WebFilter Class - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Arquivos de programas\G DATA\AntiVirus\Webfilter\AvkWebIE.dll

O3 - Toolbar: G DATA WebFilter - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Arquivos de programas\G DATA\AntiVirus\Webfilter\AvkWebIE.dll

O4 - HKLM\..\Run: [G DATA AntiVirus Trayapplication] C:\Arquivos de programas\G DATA\AntiVirus\AVKTray\AVKTray.exe

O4 - HKLM\..\Run: [soundMAXPnP] C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe

O4 - HKLM\..\Run: [soundMAX] "C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe" /tray

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [cdoosoft] C:\WINDOWS\system32\olhrwef.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Arquivos de programas\RALINK\Common\RaUI.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: G DATA AntiVirus Proxy (AVKProxy) - G DATA Software AG - C:\Arquivos de programas\Arquivos comuns\G DATA\AVKProxy\AVKProxy.exe

O23 - Service: G DATA Scheduler (AVKService) - G DATA Software AG - C:\Arquivos de programas\G DATA\AntiVirus\AVK\AVKService.exe

O23 - Service: Sentinela AntiVirus (AVKWCtl) - G DATA Software AG - C:\Arquivos de programas\G DATA\AntiVirus\AVK\AVKWCtl.exe

O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

--

End of file - 3987 bytes

DigRam · Abril 11, 2009

Bom Dia! Victorine

<@> Baixe: < > ( ...by sUBs )

<@> Salve-o no desktop!

<@> Desabilite as proteções residente de: antivírus,antispywares e firewall. ( Menos o do Windows! )

<@> Feche todas as janelas e execute a ferramenta!

<@> Na solicitação: "Negação de garantia de software" --> Clique em Sim!

<@> Não possuindo o "Console de Recuperação",aceite optar pela instalação do mesmo!

<!> Caso aconteça a notificação de: Aplicativo Win32 inválido,delete a ferramenta e faça,novamente,o download.
<!> Salve-a no desktop,renomeada como: Kombo.exe

<!> Ps: Nomeie durante o salvamento,e não após salvá-la!

<!> Ps: Surgindo alguma mensagem de erro,rode o ComboFix.exe em Modo de Segurança. <-- Link!

<!> Ps: Para completar as remoções,talvez haja necessidade da ferramenta reiniciar o computador. <-- Aguarde!

<!> Ps: Evite executar,voluntariamente,esta ferramenta!

<!> Ps: Para evitar problemas,siga todas as recomendações propostas.

<!> Ps: O ComboFix é uma ferramenta que pode danificar o sistema. Utilize-o,somente,sob supervisão profissional.

<@> Abrir-se-á a janela Auto Scan. --> Aguarde!

<@> Àfim de completar as remoções,o ComboFix poderá reiniciar o computador.

<@> Se houver necessidade,digite a opção para continuar! --> ( 1 ) --> Aperte Enter! --> Aguarde a conclusão!

<@> Durante o scan,evite manusear o mouse ou teclado! <-- Importante!

<@> Para parar ou sair do ComboFix,tecle "N" ou "2" --> Aperte Enter!

<><><><><><><><><><><><>

<@> Terminando,poste os relatórios: C:\ComboFix\ComboFix.txt + HijackThis,atualizado.

Abraços!

Victorine · Abril 11, 2009

Bom Dia! DigRam

Desde já agradeço pela ajuda. Muito obrigado!!!

Executei o ComboFix, só que ao final da execução eu tive que reiniciar o computador manualmente, mas não houve problemas. Abaixo estão os relatórios do pedidos. Aguardo respostas. Abraços!!!

ComboFix 09-04-04.01 - José Martins 2009-04-11 9:45:46.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1046.18.1023.489 [GMT -3:00]

Executando de: c:\documents and settings\José Martins\Desktop\ComboFix.exe

AV: G DATA AntiVirus *On-access scanning disabled* (Updated)

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\autorun.inf

c:\windows\system32\nmdfgds0.dll

c:\windows\system32\nmdfgds1.dll

D:\Autorun.inf

E:\Autorun.inf

.

(((((((((((((((( Arquivos/Ficheiros criados de 2009-03-11 to 2009-04-11 ))))))))))))))))))))))))))))

.

2009-04-11 01:39 . 2009-04-11 01:39 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\HP

2009-04-11 01:37 . 2009-04-11 01:37 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\Sonic

2009-04-11 01:37 . 2009-04-11 01:37 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\Sonic Shared

2009-04-11 01:37 . 2009-04-11 01:37 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\HP

2009-04-11 01:35 . 2009-04-11 01:35 <DIR> d-------- c:\arquivos de programas\Hewlett-Packard

2009-04-11 01:33 . 2009-04-11 01:33 <DIR> d-------- c:\windows\system32\URTTemp

2009-04-11 01:32 . 2009-04-11 01:32 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\Hewlett-Packard

2009-04-11 01:31 . 2008-04-13 11:45 15,104 --a------ c:\windows\system32\drivers\usbscan.sys

2009-04-11 01:31 . 2008-04-13 11:45 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys

2009-04-11 01:30 . 2009-04-11 01:30 <DIR> d-------- C:\Program Files

2009-04-11 01:30 . 1998-10-29 16:45 306,688 --a------ c:\windows\IsUninst.exe

2009-04-11 01:30 . 2004-09-29 12:12 278,584 --a------ c:\windows\system32\HPZidr12.dll

2009-04-11 01:30 . 2004-09-29 12:15 204,800 --a------ c:\windows\system32\HPZipr12.dll

2009-04-11 01:30 . 2004-09-29 12:09 94,208 --a------ c:\windows\system32\HPZipt12.dll

2009-04-11 01:30 . 2004-09-29 12:14 69,632 --a------ c:\windows\system32\HPZipm12.exe

2009-04-11 01:30 . 2004-09-29 12:08 61,440 --a------ c:\windows\system32\HPZinw12.exe

2009-04-11 01:30 . 2004-09-29 12:09 57,344 --a------ c:\windows\system32\HPZisn12.dll

2009-04-11 01:29 . 2009-04-11 01:34 <DIR> d-------- c:\arquivos de programas\HP

2009-04-11 01:28 . 2009-04-11 01:28 <DIR> d-------- c:\documents and settings\José Martins\Dados de aplicativos\HP

2009-04-11 01:28 . 2009-04-11 01:40 112,632 --a------ c:\windows\hpoins07.dat

2009-04-11 01:28 . 2005-03-08 01:43 51,120 -ra------ c:\windows\system32\drivers\HPZid412.sys

2009-04-11 01:28 . 2005-05-24 03:52 21,124 --------- c:\windows\hpomdl07.dat

2009-04-11 01:28 . 2005-03-08 01:43 16,496 -ra------ c:\windows\system32\drivers\HPZipr12.sys

2009-04-11 01:27 . 2005-03-08 01:39 274,432 -ra------ c:\windows\system32\HPZc3212.dll

2009-04-11 01:27 . 2008-04-13 11:47 25,856 --a------ c:\windows\system32\drivers\usbprint.sys

2009-04-11 01:27 . 2008-04-13 11:47 25,856 --a--c--- c:\windows\system32\dllcache\usbprint.sys

2009-04-11 01:27 . 2005-03-08 01:43 21,744 -ra------ c:\windows\system32\drivers\HPZius12.sys

2009-04-11 01:26 . 2008-04-13 11:45 32,128 --a------ c:\windows\system32\drivers\usbccgp.sys

2009-04-11 01:26 . 2008-04-13 11:45 32,128 --a--c--- c:\windows\system32\dllcache\usbccgp.sys

2009-04-11 00:17 . 2009-04-11 00:17 <DIR> d-------- c:\arquivos de programas\Trend Micro

2009-04-10 22:46 . 2009-04-10 22:46 68,424 --a------ c:\windows\system32\drivers\GRD.sys

2009-04-10 21:05 . 2004-04-26 22:49 381,056 --a------ c:\windows\system32\drivers\senfilt.sys

2009-04-10 21:05 . 2002-09-20 23:53 235,100 --a------ c:\windows\system32\drivers\MidiSyn.sys

2009-04-10 21:05 . 2004-04-07 20:41 116,176 --a------ c:\windows\system32\drivers\aeaudio.sys

2009-04-10 21:05 . 2003-08-20 08:36 65,536 --a--c--- c:\windows\system32\dllcache\a3d.dll

2009-04-10 21:05 . 2003-08-20 08:36 65,536 --a------ c:\windows\system32\a3d.dll

2009-04-10 21:04 . 2009-04-10 21:04 <DIR> d-------- c:\windows\VirtualEar

2009-04-10 21:04 . 2009-04-10 21:04 <DIR> d-------- c:\arquivos de programas\Analog Devices

2009-04-10 21:04 . 2001-09-11 15:20 1,285,632 --a------ c:\windows\system32\SMMedia.dll

2009-04-10 21:04 . 2001-10-04 15:50 991,232 --a------ c:\windows\system32\virtear.dll

2009-04-10 21:04 . 2001-09-19 13:47 765,952 --a------ c:\windows\system\crlds3d.dll

2009-04-10 21:04 . 2004-06-07 17:26 266,880 --a------ c:\windows\system32\drivers\smwdm.sys

2009-04-10 21:04 . 2003-08-19 19:36 65,536 --a------ c:\windows\system32\Audio3d.dll

2009-04-10 21:04 . 2003-06-16 08:32 49,152 --a------ c:\windows\system32\DSndUp.exe

2009-04-10 21:04 . 2002-04-17 15:05 45,056 --a------ c:\windows\system32\CleanUp.exe

2009-04-10 21:04 . 2001-09-11 15:20 30,208 --a------ c:\windows\system32\wdmioctl.dll

2009-04-10 21:04 . 2004-01-29 14:21 5,824 --a------ c:\windows\system32\drivers\ASUSHWIO.SYS

2009-04-10 21:04 . 2009-04-10 21:04 3,699 --a------ c:\windows\Ascd_tmp.ini

2009-04-10 20:53 . 2009-04-10 20:53 <DIR> d---s---- c:\documents and settings\José Martins\UserData

2009-04-10 16:20 . 2009-04-10 16:20 <DIR> d-------- c:\arquivos de programas\RALINK

2009-04-10 16:20 . 2009-04-10 21:04 <DIR> d--h----- c:\arquivos de programas\InstallShield Installation Information

2009-04-10 16:20 . 2009-04-10 16:20 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\InstallShield

2009-04-10 16:20 . 2005-05-17 15:24 311,296 --a------ c:\windows\system32\AegisI5.exe

2009-04-10 16:20 . 2006-01-19 09:20 295,016 --a------ c:\windows\system32\Install6x.dll

2009-04-10 16:20 . 2005-10-20 15:00 243,328 --a------ c:\windows\system32\drivers\RT2500.SYS

2009-04-10 16:20 . 2009-04-10 16:20 20,747 --a------ c:\windows\system32\drivers\AegisP.sys

2009-04-10 16:20 . 2005-10-26 14:22 8,192 --a------ c:\windows\system32\drivers\RT2661.bin

2009-04-10 16:20 . 2005-10-26 14:22 8,192 --a------ c:\windows\system32\drivers\RT2561s.bin

2009-04-10 16:20 . 2005-10-26 14:22 8,192 --a------ c:\windows\system32\drivers\RT2561.bin

2009-04-10 16:20 . 2005-06-16 00:30 162 --a------ c:\windows\filespec6x

2009-04-10 16:14 . 2009-04-10 16:18 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\G DATA

2009-04-10 16:14 . 2009-04-10 16:14 <DIR> d-------- c:\arquivos de programas\G DATA

2009-04-10 16:14 . 2009-04-10 16:14 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\G DATA

2009-04-10 16:14 . 2009-04-10 22:44 51,016 --a------ c:\windows\system32\drivers\GDTdiIcpt.sys

2009-04-10 16:14 . 2009-04-10 22:44 48,712 --a------ c:\windows\system32\drivers\MiniIcpt.sys

2009-04-10 16:14 . 2009-04-10 22:44 32,328 --a------ c:\windows\system32\drivers\HookCentre.sys

2009-04-10 16:11 . 2008-04-13 11:45 26,368 --a--c--- c:\windows\system32\dllcache\usbstor.sys

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-04-10 14:42 --------- d-----w c:\arquivos de programas\microsoft frontpage

2009-04-10 14:40 --------- d-----w c:\arquivos de programas\Serviços on-line

2009-04-10 14:40 --------- d-----w c:\arquivos de programas\Arquivos comuns\Serviços

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"G DATA AntiVirus Trayapplication"="c:\arquivos de programas\G DATA\AntiVirus\AVKTray\AVKTray.exe" [2008-11-25 954952]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\

Ralink Wireless Utility.lnk - c:\arquivos de programas\RALINK\Common\RaUI.exe [2009-04-10 589824]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^HP Digital Imaging Monitor.lnk]

path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\HP Digital Imaging Monitor.lnk

backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Inicialização rápida do HP Image Zone.lnk]

path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\Inicialização rápida do HP Image Zone.lnk

backup=c:\windows\pss\Inicialização rápida do HP Image Zone.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

--a------ 2005-05-11 23:12 49152 c:\arquivos de programas\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]

--a------ 2004-03-26 14:40 794624 c:\arquivos de programas\Analog Devices\SoundMAX\SMax4.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]

--a------ 2004-04-01 10:52 1368064 c:\arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

R1 GRD;G DATA Rootkit Detector Driver;c:\windows\system32\drivers\GRD.sys [2009-04-10 68424]

R2 AVKProxy;G DATA AntiVirus Proxy;c:\arquivos de programas\Arquivos comuns\G DATA\AVKProxy\AVKProxy.exe [2008-09-22 1015880]

R2 AVKService;G DATA Scheduler;c:\arquivos de programas\G DATA\AntiVirus\AVK\AVKService.exe [2008-09-22 386120]

R2 AVKWCtl;Sentinela AntiVirus;c:\arquivos de programas\G DATA\AntiVirus\AVK\AVKWCtl.exe [2008-08-14 1185496]

R2 GDTdiInterceptor;GDTdiInterceptor;c:\windows\system32\drivers\GDTdiIcpt.sys [2009-04-10 51016]

R3 GDMnIcpt;GDMnIcpt;c:\windows\system32\drivers\MiniIcpt.sys [2009-04-10 48712]

R3 HookCentre;HookCentre;c:\windows\system32\drivers\HookCentre.sys [2009-04-10 32328]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7a5a462c-2603-11de-9560-0017ad0086c1}]

\Shell\AutoRun\command - H:\luk1ylq.com

\Shell\open\Command - H:\luk1ylq.com

.

- - - - ORFÃOS REMOVIDOS - - - -

HKCU-Run-cdoosoft - c:\windows\system32\olhrwef.exe

.

------- Scan Suplementar -------

.

uStart Page = hxxp://google.com/

.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-04-11 09:46:39

Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

.

--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'winlogon.exe'(708)

c:\windows\system32\Ati2evxx.dll

.

Tempo para conclusão: 2009-04-11 9:47:22

ComboFix-quarantined-files.txt 2009-04-11 12:47:20

Pré-execução: 10 pasta(s) 26,846,253,056 bytes disponíveis

Pós execução: 9 pasta(s) 27,259,396,096 bytes disponíveis

WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

175

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 09:57:37, on 11/4/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Arquivos comuns\G DATA\AVKProxy\AVKProxy.exe

C:\Arquivos de programas\G DATA\AntiVirus\AVK\AVKService.exe

C:\Arquivos de programas\G DATA\AntiVirus\AVK\AVKWCtl.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\slserv.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\G DATA\AntiVirus\AVKTray\AVKTray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\RALINK\Common\RaUI.exe

C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE

C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896