[Resolvido!] Computador lesado + Processos suspeitos

Yukko~ · Julho 9, 2009

Ei. Olé mais uma vez.

O problema dessa vez é o seguinte: a lentidão.

Simplesmente, a velocidade caiu hmm.. pela metade quase. E assim, ao abrir o gerenciador de tarefas, percebi a presença de alguns processos que antes não haviam lá. Culpo a lentidão talvez pelo excesso de programas pesados, mas não sei, prefiro confirmar aqui.

HiJackThis

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:41:22, on 9/7/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

D:\WINDOWS\System32\smss.exe

D:\WINDOWS\system32\winlogon.exe

D:\WINDOWS\system32\services.exe

D:\WINDOWS\system32\lsass.exe

D:\WINDOWS\system32\Ati2evxx.exe

D:\WINDOWS\system32\svchost.exe

D:\WINDOWS\System32\svchost.exe

D:\WINDOWS\system32\Ati2evxx.exe

D:\WINDOWS\system32\spoolsv.exe

D:\WINDOWS\Explorer.exe

D:\WINDOWS\system32\csrcs.exe

D:\ARQUIV~1\AVG\AVG8\avgtray.exe

D:\Arquivos de programas\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE

D:\WINDOWS\RTHDCPL.EXE

D:\WINDOWS\system32\ctfmon.exe

D:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

D:\WINDOWS\system32\HPZipm12.exe

D:\Arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

D:\Arquivos de programas\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

D:\WINDOWS\system32\svchost.exe

D:\ARQUIV~1\AVG\AVG8\avgrsx.exe

D:\WINDOWS\system32\wscntfy.exe

D:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

D:\Arquivos de programas\Windows Live\Contacts\wlcomm.exe

D:\Arquivos de programas\AVG\AVG8\avgscanx.exe

D:\Arquivos de programas\AVG\AVG8\avgcsrvx.exe

D:\Arquivos de programas\Malwarebytes' Anti-Malware\mbam.exe

D:\Arquivos de programas\Mozilla Firefox\firefox.exe

D:\Documents and Settings\Gabriela\Desktop\Programas AM\HiJackThis.exe

D:\WINDOWS\system32\cmd.exe

D:\WINDOWS\system32\net.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.terra.com.br/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

F2 - REG:system.ini: Shell=Explorer.exe csrcs.exe

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - D:\Arquivos de programas\AVG\AVG8\avgssie.dll

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - D:\Arquivos de programas\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - D:\Arquivos de programas\Free Download Manager\iefdm2.dll

O2 - BHO: Neopets - {CD292324-974F-4224-D074-CACA427AA030} - D:\ARQUIV~1\Neopets\Toolbar\Toolbar.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - D:\Arquivos de programas\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: Neopets - {CD292324-974F-4224-D074-CACA427AA030} - D:\ARQUIV~1\Neopets\Toolbar\Toolbar.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - D:\Arquivos de programas\Windows Live\Toolbar\wltcore.dll

O4 - HKLM\..\Run: [startCCC] "D:\Arquivos de programas\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"

O4 - HKLM\..\Run: [AVG8_TRAY] D:\ARQUIV~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe

O4 - HKLM\..\Policies\Explorer\Run: [csrcs] D:\WINDOWS\system32\csrcs.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: Baixar com o FDM - file://D:\Arquivos de programas\Free Download Manager\dllink.htm

O8 - Extra context menu item: Baixar tudo com o FDM - file://D:\Arquivos de programas\Free Download Manager\dlall.htm

O8 - Extra context menu item: Download selecionado pelo FDM - file://D:\Arquivos de programas\Free Download Manager\dlselected.htm

O8 - Extra context menu item: Download video with Free Download Manager - file://D:\Arquivos de programas\Free Download Manager\dlfvideo.htm

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://D:\ARQUIV~1\MICROS~3\Office12\EXCEL.EXE/3000

O9 - Extra button: Incluir no Blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Arquivos de programas\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Incluir no Blog no Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Arquivos de programas\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\ARQUIV~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\ARQUIV~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\ARQUIV~1\MICROS~3\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/PT-BR/a-UNO1/GAME_UNO1.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Arquivos de programas\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - D:\Arquivos de programas\AVG\AVG8\avgpp.dll

O20 - Winlogon Notify: avgrsstarter - D:\WINDOWS\SYSTEM32\avgrsstx.dll

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - D:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\system32\HPZipm12.exe

--

End of file - 7037 bytes

Agradeço desde já, queridos :*

MGuitar · Julho 10, 2009

1ª Etapa

- Faça o download do SDFix e salve no desktop;

● Dê um duplo clique no SDFix.exe e a ferramenta será instalada em D:\SDFix. Mas não o execute ainda;

● Reinicie seu computador seu computador em Modo de Segurança (segurando a tecla F8 durante a inicialização do sistema e escolhendo a opção Modo Seguro);

● Entre na pasta do SDFix que foi instalada no seu computador e dê um duplo clique no arquivo RunThis.bat;

● Tecle Y para que a ferramenta inicie o processo de remoção;

● Quando tudo terminar, você verá um aviso dizendo para apertar qualquer tecla para continuar. Faça isso. Seu computador será reiniciado automaticamente;

● Após reiniciar, a ferramenta ainda será executada novamente, irá terminar o seu trabalho e a palavra Finished irá aparecer. Pressione qualquer tecla novamente;

● Uma janela com o relatório do SDFix irá aparecer;

● O log abrirá automaticamente para você. Estará salvo na pasta do SDFix com o nome Report.txt;

Faça um novo log do HijackThis e cole na sua próxima resposta, juntamente com o log do SDFix.

2ª Etapa

- Faça o download do ComboFix e salve-o na área de trabalho;

● Desative temporariamente o seu antivirus para não detectar a ferramenta como vírus;

● Duplo clique no ícone combofix.exe para iniciar o scan;

● Leia o contrato que aparecerá e clique em Sim para continuar;

● Abrirá uma janela do Console de Recuperação, clique em Sim para instalar. Se aparecer outra janela do Console, clique em OK > Sim;

● Aguarde enquanto o ComboFix faz o scan;

● Se ocorrer algum problema durante o scan, reinicie seu computador em Modo de Segurança e repita o procedimento;

● Não clique na janela do ComboFix e procure não utilizar o teclado também, para não atrapalhar a varredura da ferramenta;

● Se quiser sair ou parar o ComboFix, tecle N;

● Quando terminar seu micro será reiniciado. Após o reinicio, a ferramenta executará novamente, aguarde;

● Será gerado um log em D:\ComboFix.txt.

Em sua próxima resposta, cole os logs do SDFix e ComboFix, por favor.

Yukko~ · Julho 10, 2009

Aqui estãos os logs:

SDFix

SDFix: Version 1.240

Run by Gabriela on --- 10/07/2009 at 18:54

Microsoft Windows XP [versÆo 5.1.2600]

Running From: D:\SDFix

Checking Services :

Restoring Default Security Values

Restoring Default Hosts File

Rebooting

Checking Files :

Trojan Files Found:

D:\WINDOWS\system32\csrcs.exe - Deleted

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-07-10 18:59:28

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gfktlge]

"DisplayName"="Image Config"

"Type"=dword:00000020

"Start"=dword:00000002

"ErrorControl"=dword:00000000

"ImagePath"=str(2):"%SystemRoot%\system32\svchost.exe -k netsvcs"

"ObjectName"="LocalSystem"

"Description"="Fornece configuração automática para os adaptadores 802.11"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gfktlge\Parameters]

"ServiceDll"=str(2):"D:\WINDOWS\system32\zaajaomz.dll"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]

"s1"=dword:2df9c43f

"s2"=dword:110480d0

"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]

"p0"="D:\Arquivos de programas\DAEMON Tools Lite\"

"h0"=dword:00000000

"khjeh"=hex:be,46,0f,2f,2b,cc,fb,ab,5b,66,a1,d8,00,2c,c3,42,9f,f9,57,db,13,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]

"a0"=hex:20,01,00,00,2f,4c,80,2c,95,15,24,2d,0b,0e,c0,8a,d1,5c,12,0a,b1,..

"khjeh"=hex:69,aa,84,f8,6d,7b,dc,46,0d,e4,40,38,fd,cd,a2,92,58,a2,0f,48,cc,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]

"khjeh"=hex:8b,28,8d,fd,a6,5e,08,c9,91,08,c7,ab,7d,b6,67,70,35,99,87,f7,b7,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\gfktlge]

"DisplayName"="Image Config"

"Type"=dword:00000020

"Start"=dword:00000002

"ErrorControl"=dword:00000000

"ImagePath"=str(2):"%SystemRoot%\system32\svchost.exe -k netsvcs"

"ObjectName"="LocalSystem"

"Description"="Fornece configuração automática para os adaptadores 802.11"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\gfktlge\Parameters]

"ServiceDll"=str(2):"D:\WINDOWS\system32\zaajaomz.dll"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]

"p0"="D:\Arquivos de programas\DAEMON Tools Lite\"

"h0"=dword:00000000

"khjeh"=hex:be,46,0f,2f,2b,cc,fb,ab,5b,66,a1,d8,00,2c,c3,42,9f,f9,57,db,13,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]

"a0"=hex:20,01,00,00,2f,4c,80,2c,95,15,24,2d,0b,0e,c0,8a,d1,5c,12,0a,b1,..

"khjeh"=hex:69,aa,84,f8,6d,7b,dc,46,0d,e4,40,38,fd,cd,a2,92,58,a2,0f,48,cc,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]

"khjeh"=hex:8b,28,8d,fd,a6,5e,08,c9,91,08,c7,ab,7d,b6,67,70,35,99,87,f7,b7,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden services: 0

hidden files: 0

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"D:\\Arquivos de programas\\Messenger\\msmsgs.exe"="D:\\Arquivos de programas\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"

"D:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="D:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe"

"D:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqste08.exe"="D:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"

"D:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="D:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"

"D:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hposfx08.exe"="D:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"

"D:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hposid01.exe"="D:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"

"D:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="D:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"

"D:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="D:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"

"D:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="D:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"

"D:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="D:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"

"D:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="D:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"

"D:\\Arquivos de programas\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="D:\\Arquivos de programas\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"

"D:\\Arquivos de programas\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="D:\\Arquivos de programas\\HP\\Digital Imaging\\Unload\\HpqDIA.exe:*:Enabled:hpqdia.exe"

"D:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpoews01.exe"="D:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"

"D:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"="D:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"

"D:\\Arquivos de programas\\DreMule\\emule.exe"="D:\\Arquivos de programas\\DreMule\\emule.exe:*:Enabled:Dreamule"

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"D:\\Arquivos de programas\\BitTorrent\\bittorrent.exe"="D:\\Arquivos de programas\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent"

"D:\\Arquivos de programas\\Free Download Manager\\fdm.exe"="D:\\Arquivos de programas\\Free Download Manager\\fdm.exe:*:Enabled:Free Download Manager"

"D:\\Arquivos de programas\\Microsoft Office\\Office12\\OUTLOOK.EXE"="D:\\Arquivos de programas\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"

"D:\\Arquivos de programas\\Microsoft Office\\Office12\\GROOVE.EXE"="D:\\Arquivos de programas\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove"

"D:\\Arquivos de programas\\Microsoft Office\\Office12\\ONENOTE.EXE"="D:\\Arquivos de programas\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"

"D:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"="D:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"

"D:\\Arquivos de programas\\Windows Live\\Sync\\WindowsLiveSync.exe"="D:\\Arquivos de programas\\Windows Live\\Sync\\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"

"D:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"="D:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

"D:\\Arquivos de programas\\AVG\\AVG8\\avgupd.exe"="D:\\Arquivos de programas\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe"

"D:\\Arquivos de programas\\Electronic Arts\\EADM\\Core.exe"="D:\\Arquivos de programas\\Electronic Arts\\EADM\\Core.exe:*:Enabled:EA Download Manager"

"D:\\Arquivos de programas\\Electronic Arts\\MySims\\bin\\MySims.exe"="D:\\Arquivos de programas\\Electronic Arts\\MySims\\bin\\MySims.exe:*:Enabled:MySims"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"D:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"="D:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"

"D:\\Arquivos de programas\\Windows Live\\Sync\\WindowsLiveSync.exe"="D:\\Arquivos de programas\\Windows Live\\Sync\\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"

"D:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"="D:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

Remaining Files :

File Backups: - D:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Tue 3 Aug 2004 93,184 A.SH. --- "D:\Arquivos de programas\Internet Explorer\iexplore.exe"

Tue 3 Aug 2004 60,416 A.SH. --- "D:\Arquivos de programas\Outlook Express\msimn.exe"

Wed 22 Oct 2008 949,072 A.SHR --- "D:\Arquivos de programas\Spybot - Search & Destroy\advcheck.dll"

Mon 15 Sep 2008 1,562,960 A.SHR --- "D:\Arquivos de programas\Spybot - Search & Destroy\SDHelper.dll"

Wed 22 Oct 2008 962,896 A.SHR --- "D:\Arquivos de programas\Spybot - Search & Destroy\Tools.dll"

Tue 14 Oct 2008 0 A.SH. --- "D:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

Sat 28 Feb 2009 208,480 A..H. --- "D:\Documents and Settings\Gabriela\Desktop\Free Download Manager\cake-mania-2_s1_l1_gF2152T1L1_d451886931.exe"

Sun 1 Mar 2009 208,480 A..H. --- "D:\Documents and Settings\Gabriela\Desktop\Free Download Manager\cake-mania-3_s1_l1_gF2662T1L1_d453365262.exe"

Thu 18 Dec 2008 20,403,816 A..H. --- "D:\Documents and Settings\Gabriela\Desktop\Free Download Manager\FSS_PH60.exe"

Fri 30 Jan 2009 17,904,352 A..H. --- "D:\Documents and Settings\Gabriela\Desktop\Free Download Manager\InstallBellesBeautyBoutique.exe"

Tue 9 Dec 2008 15,689,006 A..H. --- "D:\Documents and Settings\Gabriela\Desktop\Free Download Manager\klcodec434f.exe"

Tue 10 Jun 2008 1,179,648 A.SH. --- "D:\Documents and Settings\Gabriela\Meus documentos\101MSDCF\SIV2EA.tmp"

Tue 10 Jun 2008 1,560,576 A.SH. --- "D:\Documents and Settings\Gabriela\Meus documentos\101MSDCF\SIV2EB.tmp"

Tue 10 Jun 2008 1,179,648 A.SH. --- "D:\Documents and Settings\Gabriela\Meus documentos\DCIM\101MSDCF\SIV2EA.tmp"

Tue 10 Jun 2008 1,560,576 A.SH. --- "D:\Documents and Settings\Gabriela\Meus documentos\DCIM\101MSDCF\SIV2EB.tmp"

Finished!

HiJackThis

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:04:11, on 10/7/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

D:\WINDOWS\System32\smss.exe

D:\WINDOWS\system32\winlogon.exe

D:\WINDOWS\system32\services.exe

D:\WINDOWS\system32\lsass.exe

D:\WINDOWS\system32\Ati2evxx.exe

D:\WINDOWS\system32\svchost.exe

D:\WINDOWS\System32\svchost.exe

D:\WINDOWS\system32\Ati2evxx.exe

D:\WINDOWS\Explorer.EXE