[Resolvido] Windows XP sem som

Clarissa Gonçalves · Julho 22, 2009

Meu computador estava funcionando perfeitamente há mais de 1 ano.

Porém, repentinamente, ele não está mais enviando som para as caixas/fone.

Já reinstalei o driver, codec e, até mesmo, o windows (apenas no modo de Reparar a instalação).

Ao colocar algum audio a ser executado, ele executa o som normalmente (no Windows Media Player, por exemplo), mas o som não sai.

Como o meu firefox estava apresentando alguns problemas para acessar contas bancárias, imaginei q algum virus possa ter corrompido algum arquivo, ou coisa do tipo.

Enfim, segue o log do Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 23:45:23, on 21/7/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\ARQUIV~1\GbPlugin\GbpSv.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Eset\nod32kui.exe

C:\Arquivos de programas\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe

C:\Arquivos de programas\D-Tools\daemon.exe

C:\WINDOWS\VM30xSnap.exe

C:\Arquivos de programas\Java\jre6\bin\jusched.exe

C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\Arquivos de programas\BrOffice.org 2.2\program\soffice.exe

C:\Arquivos de programas\BrOffice.org 2.2\program\soffice.BIN

C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Arquivos de programas\Bonjour\mDNSResponder.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\Arquivos de programas\Eset\nod32krn.exe

c:\Arquivos de programas\Arquivos comuns\Protexis\License Service\PsiService_2.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\iPod\bin\iPodService.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\System32\alg.exe

C:\Arquivos de programas\Arquivos comuns\Adobe\Updater5\AdobeUpdater.exe

C:\Arquivos de programas\Windows Live\Messenger\usnsvc.exe

C:\HiJackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: CompSegIB - {2E3C3651-B19C-4DD9-A979-901EC3E930AF} - C:\Arquivos de programas\Scpad\scpsssh2.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\ARQUIV~1\GBPLUGIN\gbieh.dll

O2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\Arquivos de programas\GbPlugin\gbiehcef.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [nod32kui] "C:\Arquivos de programas\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Arquivos de programas\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe

O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Arquivos de programas\D-Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [VM30xSnap] VM30xSnap.exe Vimicro USB PC Camera (ZC030x)

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [TkBellExe] "C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [JavaPlugin] C:\DOCUME~1\Bastos\CONFIG~1\Temp\taskmgrs.exe

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Bastos\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [cdoosoft] C:\WINDOWS\system32\olhrwef.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: BrOffice.org 2.2.lnk = C:\Arquivos de programas\BrOffice.org 2.2\program\quickstart.exe

O4 - Startup: PowerToChange.lnk = C:\Arquivos de programas\PowerToChange\PowerToChange.exe

O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Arquivos de programas\MP3 Player Utilities 3.70\AMVConverter\grab.html

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Arquivos de programas\MP3 Player Utilities 3.70\MediaManager\grab.html

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {051D0E35-F4E3-4C8D-B411-AB0875F4C683} (Anark Client 4.0 ActiveX Control) - http://install.anark.com/client/version4/windows-ie/en/AMClient.cab

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/PT-BR/a-UNO1/GAME_UNO1.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1205652661781

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1205653159890

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} (GbpDistObj Class) - https://www14.bancobrasil.com.br/plugin/GbpDist.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{1A85F0EA-8CA2-47FA-BB0B-77964EB47249}: NameServer = 200.165.132.154 200.165.132.148

O17 - HKLM\System\CS1\Services\Tcpip\..\{1A85F0EA-8CA2-47FA-BB0B-77964EB47249}: NameServer = 200.165.132.154 200.165.132.148

O20 - Winlogon Notify: GbPluginBb - C:\ARQUIV~1\GBPLUGIN\gbieh.dll

O20 - Winlogon Notify: GbPluginCef - C:\Arquivos de programas\GbPlugin\gbiehcef.dll

O21 - SSODL: CompIBBrd - {A3717295-941D-416F-9384-ED1736729F1C} - C:\Arquivos de programas\Scpad\scpLIB.dll

O22 - SharedTaskScheduler: scpLIB - {A3717295-941D-416F-9384-ED1736729F1C} - C:\Arquivos de programas\Scpad\scpLIB.dll

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Arquivos de programas\Ares\chatServer.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Arquivos de programas\Bonjour\mDNSResponder.exe

O23 - Service: Gbp Service (GbpSv) - - C:\ARQUIV~1\GbPlugin\GbpSv.exe

O23 - Service: Serviço iPod (iPod Service) - Apple Inc. - C:\Arquivos de programas\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe

O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB6p5\webserver\bin\win32\matlabserver.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Arquivos de programas\Eset\nod32krn.exe

O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Arquivos de programas\Arquivos comuns\Protexis\License Service\PsiService_2.exe

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Arquivos de programas\WinPcap\rpcapd.exe

--

End of file - 10325 bytes

DigRam · Julho 22, 2009

Boa Noite! Clarissa Gonçalves

<@> Baixe: < > ( ...by sUBs )

<@> Salve-o no desktop!

<@> Desabilite as proteções residente de: antivírus,antispywares e firewall. ( Menos o do Windows! )

<@> Feche todas as janelas e execute a ferramenta!

<@> Na solicitação: "Negação de garantia de software" --> Clique em Sim!

<@> Não possuindo o "Console de Recuperação",aceite optar pela instalação do mesmo!

<!> Caso aconteça a notificação de: Aplicativo Win32 inválido,delete a ferramenta ComboFix.exe e faça,novamente,seu download.

<!> Salve-a no desktop,renomeada como: Kombo.exe

<!> Ps: Nomeie durante o salvamento,e não após salvá-la!

<!> Ps: Surgindo alguma mensagem de erro,rode o ComboFix.exe em "Modo de Segurança". <-- Link!

<!> Ps: Para completar as remoções,talvez haja necessidade da ferramenta reiniciar o computador. <-- Aguarde!

<!> Ps: Evite executar,voluntariamente,esta ferramenta!

<!> Ps: Para evitar problemas,siga todas as recomendações propostas.

<!> Ps: O ComboFix é uma ferramenta que pode danificar o sistema. Utilize-o,somente,sob supervisão profissional.

<@> Abrir-se-á a janela Auto Scan. --> Aguarde!

<@> Àfim de completar as remoções,o ComboFix poderá reiniciar o computador.

<@> Se houver necessidade,digite a opção para continuar! --> ( 1 ) --> Aperte Enter! --> Aguarde a conclusão!

<@> Durante o scan,evite manusear o mouse ou teclado! <-- Importante!

<@> Para parar ou sair do ComboFix,tecle "N" ou "2" --> Aperte Enter!

<><><><><><><><><><><><>

<@> Terminando,poste os relatórios: C:\ComboFix.txt + HijackThis,atualizado.

Abraços!

Clarissa Gonçalves · Julho 22, 2009

Olá, DigRam.

Fiz o que você pediu.

Segue os dois logs (ComboFix e hijackthis).

======

ComboFix 09-07-21.03 - Bastos 22/07/2009 1:15.1.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.55.1046.18.2039.1589 [GMT -3:00]

Executando de: c:\documents and settings\Bastos\Desktop\ComboFix.exe

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Bastos\Dados de aplicativos\inst.exe

c:\windows\Downloaded Program Files\popcaploader.dll

c:\windows\Downloaded Program Files\popcaploader.inf

c:\windows\Installer\1451bd.msp

c:\windows\Installer\4123c.msp

c:\windows\Installer\4bf506.msi

c:\windows\Installer\4d26a06.msp

.

((((((((((((((((((((((((((((((((((((((( Drivers/Serviços )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_AVPsys

(((((((((((((((( Arquivos/Ficheiros criados de 2009-06-22 to 2009-07-22 ))))))))))))))))))))))))))))

.

2009-07-22 02:38 . 2009-07-22 02:38 401720 ----a-w- C:\HiJackThis.exe

2009-07-21 22:57 . 2009-07-21 22:57 -------- d-----w- c:\windows\system32\CatRoot_bak

2009-07-21 08:38 . 2009-07-21 09:12 319488 ----a-w- c:\windows\HideWin.exe

2009-07-21 08:23 . 2008-02-15 15:49 180224 ----a-w- c:\windows\system32\igfxres.dll

2009-07-21 06:40 . 2004-08-04 03:45 8192 -c--a-w- c:\windows\system32\dllcache\httpmb51.dll

2009-07-21 06:08 . 2001-10-28 15:06 16384 -c--a-w- c:\windows\system32\dllcache\isignup.exe

2009-07-21 00:49 . 2001-10-28 15:06 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll

2009-07-21 00:49 . 2001-10-28 15:06 13312 ----a-w- c:\windows\system32\irclass.dll

2009-07-21 00:49 . 2001-10-28 15:07 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll

2009-07-21 00:49 . 2001-10-28 15:07 24661 ----a-w- c:\windows\system32\spxcoins.dll

2009-07-20 20:18 . 2009-06-26 17:37 40960 ------w- c:\windows\system32\RtkCoInstXP.dll

2009-07-20 19:22 . 2009-07-20 19:22 -------- d-----w- c:\arquivos de programas\Lavalys

2009-07-20 18:54 . 2009-07-20 18:54 -------- d-----w- c:\windows\system32\wbem\Repository

2009-07-06 14:13 . 2009-07-06 14:13 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-07-22 04:20 . 2008-10-19 00:17 -------- d-----w- c:\documents and settings\Bastos\Dados de aplicativos\BrOffice.org2

2009-07-22 04:08 . 2009-06-15 16:36 271 ----a-w- c:\documents and settings\Bastos\cfg1.reg

2009-07-22 04:08 . 2009-06-15 16:36 270 ----a-w- c:\documents and settings\Bastos\cfg.reg

2009-07-22 04:07 . 2008-03-16 05:22 -------- d-----w- c:\arquivos de programas\ESET

2009-07-22 04:03 . 2008-03-16 06:32 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\GbPlugin

2009-07-21 21:27 . 2008-06-03 17:13 -------- d-----w- c:\documents and settings\Bastos\Dados de aplicativos\gtk-2.0

2009-07-21 06:44 . 2001-10-28 15:07 67450 ----a-w- c:\windows\system32\perfc016.dat

2009-07-21 06:44 . 2001-10-28 15:07 425426 ----a-w- c:\windows\system32\perfh016.dat

2009-07-21 06:07 . 2008-03-16 05:01 22980 -c--a-w- c:\windows\system32\emptyregdb.dat

2009-07-20 20:35 . 2008-03-16 05:14 -------- d--h--w- c:\arquivos de programas\InstallShield Installation Information

2009-07-20 20:29 . 2008-03-16 05:14 -------- d-----w- c:\arquivos de programas\Realtek

2009-07-09 22:20 . 2008-08-15 09:00 -------- d-----w- c:\arquivos de programas\Fotki Desktop

2009-06-25 17:50 . 2008-03-16 06:32 -------- d-----w- c:\arquivos de programas\GbPlugin

2009-06-24 13:43 . 2009-07-20 20:35 831488 ----a-w- c:\windows\RtlExUpd.dll

2009-06-16 14:39 . 2004-08-04 03:45 119808 ----a-w- c:\windows\system32\t2embed(2).dll

2009-06-15 22:19 . 2009-01-15 17:13 27056 ----a-w- c:\windows\system32\drivers\GbpKm.sys

2009-06-09 18:45 . 2009-06-09 18:45 -------- d-----w- c:\arquivos de programas\GVOX

2009-06-05 14:11 . 2009-06-05 14:11 -------- d-----w- c:\documents and settings\Bastos\Dados de aplicativos\com.hp.air.powertochange.widget.D8CCA4DBE98F0F089C13215DBC0336724477D422.1

2009-06-05 14:11 . 2009-06-05 14:11 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Adobe AIR

2009-06-05 14:10 . 2009-06-05 14:11 38208 ----a-w- c:\documents and settings\Bastos\Dados de aplicativos\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

2009-06-03 19:10 . 2004-08-04 03:45 1295872 ----a-w- c:\windows\system32\quartz(2).dll

2009-06-02 10:59 . 2008-03-28 22:32 -------- d-----w- c:\documents and settings\Bastos\Dados de aplicativos\uTorrent

2009-05-31 20:43 . 2009-05-26 21:26 -------- d-----w- c:\arquivos de programas\Project64 1.6

2009-05-26 21:26 . 2009-05-26 21:26 8854 ----a-r- c:\documents and settings\Bastos\Dados de aplicativos\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\Uninstall_Project64__9559F7CA5E344237A2D9D856464AD727.exe

2009-05-26 21:26 . 2009-05-26 21:26 40960 ----a-r- c:\documents and settings\Bastos\Dados de aplicativos\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\NewShortcut1_9559F7CA5E344237A2D9D856464AD727.exe

2009-05-26 21:26 . 2009-05-26 21:26 40960 ----a-r- c:\documents and settings\Bastos\Dados de aplicativos\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\ARPPRODUCTICON.exe

2009-05-03 20:42 . 2009-05-03 20:42 2678 ----a-w- c:\windows\java\Packages\Data\KUMWIBJX.DAT

2009-05-03 20:42 . 2009-05-03 20:42 2678 ----a-w- c:\windows\java\Packages\Data\2PZ3ZVT3.DAT

2009-05-03 20:42 . 2009-05-03 20:42 2678 ----a-w- c:\windows\java\Packages\Data\NJLN53LZ.DAT

2009-05-03 20:42 . 2009-05-03 20:42 2678 ----a-w- c:\windows\java\Packages\Data\IB9F5F1F.DAT

2009-05-03 20:42 . 2009-05-03 20:42 2678 ----a-w- c:\windows\java\Packages\Data\5N3ZBX3T.DAT

2009-06-13 10:24 . 2008-08-31 01:16 134648 ----a-w- c:\arquivos de programas\mozilla firefox\components\brwsrcmp.dll

2006-05-03 10:06 . 2008-09-14 18:25 163328 --sha-r- c:\windows\system32\flvDX.dll

2007-02-21 11:47 . 2008-09-14 18:25 31232 -csha-r- c:\windows\system32\msfDX.dll

2007-12-17 13:43 . 2008-09-14 18:26 27648 -csha-w- c:\windows\system32\Smab0.dll

2008-02-04 19:26 . 2008-09-14 18:26 151040 -csha-w- c:\windows\system32\VistaUltm.dll

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

"MSMSGS"="c:\arquivos de programas\Messenger\msmsgs.exe" [2008-04-13 1695232]

"Google Update"="c:\documents and settings\Bastos\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe" [2008-09-23 133104]

"AdobeUpdater"="c:\arquivos de programas\Arquivos comuns\Adobe\Updater5\AdobeUpdater.exe" [2008-09-26 2356088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]

"QuickTime Task"="c:\arquivos de programas\QuickTime\qttask.exe" [2008-02-01 385024]

"iTunesHelper"="c:\arquivos de programas\iTunes\iTunesHelper.exe" [2008-02-19 267048]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2003-05-16 188416]

"DAEMON Tools-1033"="c:\arquivos de programas\D-Tools\daemon.exe" [2004-08-22 81920]

"SunJavaUpdateSched"="c:\arquivos de programas\Java\jre6\bin\jusched.exe" [2009-02-12 148888]

"Adobe Reader Speed Launcher"="c:\arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]

"TkBellExe"="c:\arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" [2009-04-01 198160]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-15 135168]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-15 159744]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-15 131072]

"VM30xSnap"="VM30xSnap.exe" - c:\windows\VM30xSnap.exe [2007-02-15 53248]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2009-03-12 17531392]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\Bastos\Menu Iniciar\Programas\Inicializar\

BrOffice.org 2.2.lnk - c:\arquivos de programas\BrOffice.org 2.2\program\quickstart.exe [2007-3-31 393216]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{E37CB5F0-51F5-4395-A808-5FA49E399003}"= "c:\arquivos de programas\GbPlugin\gbiehcef.dll" [2009-01-27 404032]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginBb]

2009-06-18 21:00 302368 ----a-w- c:\arquiv~1\GbPlugin\gbieh.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginCef]

2009-01-27 16:40 404032 ----a-w- c:\arquivos de programas\GbPlugin\gbiehcef.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0sprestrt\0sprestrt

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\Bonjour\\mDNSResponder.exe"=

"c:\\Arquivos de programas\\iTunes\\iTunes.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Arquivos de programas\\JustVoip.com\\JustVoip\\JustVoip.exe"=

"c:\\Arquivos de programas\\uTorrent\\uTorrent.exe"=

"c:\\Arquivos de programas\\Ares\\Ares.exe"=

"c:\\Arquivos de programas\\Megacubo\\megacubo.exe"=

"c:\\Arquivos de programas\\Megacubo\\bin\\minifly.exe"=

"c:\\Arquivos de programas\\gnucash\\bin\\gnucash-bin.exe"=

"c:\\Arquivos de programas\\gnucash\\bin\\gconfd-2.exe"=

"c:\\Arquivos de programas\\SPSSInc\\SPSS16\\spss.exe"=

"c:\\Arquivos de programas\\SPSSInc\\SPSS16\\spss.com"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"=

R2 GbpSv;Gbp Service;c:\arquiv~1\GbPlugin\GbpSv.exe [16/3/2008 03:33 53552]

R3 VM30xx86;Vimicro USB PC Camera (ZC0301);c:\windows\system32\drivers\vm30xx86.sys [13/1/2009 19:05 1294464]

S0 GbpKm;Gbp KernelMode;c:\windows\system32\drivers\GbpKm.sys [15/1/2009 14:13 27056]

S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [20/7/2009 17:35 1684736]

S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [6/11/2007 17:22 34064]

.

Conteúdo da pasta 'Tarefas Agendadas'

2009-07-21 c:\windows\Tasks\User_Feed_Synchronization-{F341D0DF-99C3-4C63-B66C-635BCB9505D9}.job

- c:\windows\system32\msfeedssync.exe [2007-08-13 07:31]

.

- - - - ORFÃOS REMOVIDOS - - - -

HKLM-Run-PHIME2002ASync - c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

HKLM-Run-PHIME2002A - c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

.

------- Scan Suplementar -------

.

uStart Page = about:blank

IE: Add to AMV Convert Tool... - c:\arquivos de programas\MP3 Player Utilities 3.70\AMVConverter\grab.html

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: MediaManager tool grab multimedia file - c:\arquivos de programas\MP3 Player Utilities 3.70\MediaManager\grab.html

TCP: {1A85F0EA-8CA2-47FA-BB0B-77964EB47249} = 200.165.132.154 200.165.132.148

DPF: {051D0E35-F4E3-4C8D-B411-AB0875F4C683} - hxxp://install.anark.com/client/version4/windows-ie/en/AMClient.cab

DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} - hxxps://www14.bancobrasil.com.br/plugin/GbpDist.cab

FF - ProfilePath - c:\documents and settings\Bastos\Dados de aplicativos\Mozilla\Firefox\Profiles\owgbm01i.default\extensions\{987311C6-B504-4aa2-90BF-60CC49808D42}(2)\defaults(2)\preferences(2)\

FF - prefs.js: network.proxy.type - 2

---- FIREFOX POLICIES ----

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-07-22 01:20

Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

.

--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\•€|ÿÿÿÿ"•€|þ»Òw*]

"6140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'winlogon.exe'(796)

c:\arquiv~1\GBPLUGIN\gbieh.dll

c:\arquivos de programas\GbPlugin\gbiehcef.dll

- - - - - - - > 'explorer.exe'(2252)

c:\windows\system32\msi.dll

c:\arquiv~1\GBPLUGIN\gbieh.dll

c:\arquivos de programas\GbPlugin\gbiehcef.dll

c:\arquivos de programas\Scpad\scpLIB.dll

c:\arquivos de programas\Scpad\scpMIB.dll

c:\arquivos de programas\Scpad\sshib.dll

.

------------------------ Outros Processos em Execução ------------------------

.

c:\arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\arquivos de programas\Bonjour\mDNSResponder.exe

c:\windows\system32\igfxsrvc.exe

c:\arquivos de programas\Java\jre6\bin\jqs.exe

c:\arquivos de programas\Arquivos comuns\Protexis\License Service\PsiService_2.exe

c:\arquivos de programas\BrOffice.org 2.2\program\soffice.exe

c:\arquivos de programas\BrOffice.org 2.2\program\soffice.bin

c:\arquivos de programas\iPod\bin\iPodService.exe

c:\windows\system32\wscntfy.exe

c:\windows\system32\wbem\wmiapsrv.exe

.

**************************************************************************

.

Tempo para conclusão: 2009-07-22 1:24 - Máquina reiniciou

ComboFix-quarantined-files.txt 2009-07-22 04:24

Pré-execução: 14 pasta(s) 59.331.518.464 bytes disponíveis

Pós execução: 14 pasta(s) 61.544.906.752 bytes disponíveis

WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

244 --- E O F --- 2009-07-21 16:02

=========

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 01:28:45, on 22/7/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\ARQUIV~1\GbPlugin\GbpSv.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe

C:\Arquivos de programas\D-Tools\daemon.exe

C:\WINDOWS\VM30xSnap.exe

C:\Arquivos de programas\Java\jre6\bin\jusched.exe

C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Arquivos de programas\Bonjour\mDNSResponder.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\Arquivos de programas\Messenger\msmsgs.exe

c:\Arquivos de programas\Arquivos comuns\Protexis\License Service\PsiService_2.exe

C:\Arquivos de programas\BrOffice.org 2.2\program\soffice.exe

C:\Arquivos de programas\BrOffice.org 2.2\program\soffice.BIN

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\iPod\bin\iPodService.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\explorer.exe

C:\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://216.220.167.110/proxy.pac