[Arquivado] Análise de Log/Virus WIN32/Cutwail

ig0rf · Agosto 25, 2009

Boa noite! hoje peguei um virus de manhã.. o html framer.. e nao tava conseguindo tirar. aí resolvi reiniciar e simplesmente não inicializava mais o windows, pq parece que tinha corrompido o userinit.exe, que é o arquivo que faz o logon do windows.. aí o proprio windows não deixava o arquivo rodar e não tinha como eu logar.. suspeitei que tinha pego outro virus, ai resolvi rodar aquele detector e malware da microsoft..

o relatorio final foi +/- esse:

trojan downloader:win32/zlob.gen - removido

virtool:winnt/cutwail.L - parcialmente removido

virus:win32/cutwail.F - parcialmente removido

aí fiquei tentando ligar o pc em seguida e dava o mesmo erro.. até que na 3 tentativa consegui.. aí deixei passando um AVG pra verificar e como sempre lia as coisas aqui, resolvi perguntar pra vocês.. afinal, bem mais seguro que ficar fazendo as coisas por mim.. vejam o log do HiJackThis

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:36:18, on 25/8/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal

Running processes:

H:\WINDOWS\System32\smss.exe

H:\WINDOWS\system32\winlogon.exe

H:\WINDOWS\system32\services.exe

H:\WINDOWS\system32\lsass.exe

H:\WINDOWS\system32\svchost.exe

H:\WINDOWS\System32\svchost.exe

H:\WINDOWS\system32\svchost.exe

H:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

H:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

H:\ARQUIV~1\AVG\AVG8\avgrsx.exe

H:\ARQUIV~1\AVG\AVG8\avgnsx.exe

H:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBService.exe

H:\WINDOWS\System32\svchost.exe

H:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

H:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

H:\WINDOWS\system32\nvsvc32.exe

H:\WINDOWS\system32\svchost.exe

H:\ARQUIV~1\AVG\AVG8\avgemc.exe

H:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

H:\Arquivos de programas\AVG\AVG8\avgcsrvx.exe

H:\WINDOWS\system32\svchost.exe

H:\WINDOWS\system32\6.tmp

H:\WINDOWS\System32\svchost.exe

H:\WINDOWS\System32\avast!UpdateAgent.exe

H:\WINDOWS\TEMP\1.EXE

H:\WINDOWS\Explorer.EXE

H:\WINDOWS\system32\servises.exe

H:\WINDOWS\system32\ctfmon.exe

H:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

H:\WINDOWS\system32\wuauclt.exe

H:\Documents and Settings\usuario\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://br.ask.com?o=14784&l=dis

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - H:\Arquivos de programas\AVG\AVG8\avgssie.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - H:\Arquivos de programas\Java\jre1.5.0_12\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - H:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - H:\Arquivos de programas\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - H:\Arquivos de programas\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll

O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - H:\Arquivos de programas\Ask.com\GenericAskToolbar.dll

O2 - BHO: TBSB00982 - {DA3D342F-FF20-4E31-9E82-22334155730C} - H:\Arquivos de programas\IEToolbar\Ant.com Toolbar\tbcore3.dll

O2 - BHO: AntBar - {e1a96b41-e013-47be-99f5-38a5a0d45e23} - H:\Arquivos de programas\Ant.com\Ant.com IE toolbar\adxloader.dll

O3 - Toolbar: Ant.com - {a2ccec8c-e692-41d8-a4fd-4db8f2af59e9} - H:\Arquivos de programas\Ant.com\Ant.com IE toolbar\adxloader.dll

O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - H:\Arquivos de programas\Ask.com\GenericAskToolbar.dll

O3 - Toolbar: Ant.com Toolbar - {6CD56C02-CB4D-41B5-A0FE-B479061CCB41} - H:\Arquivos de programas\IEToolbar\Ant.com Toolbar\tbcore3.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - H:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [19910] H:\WINDOWS\system32\6.tmp.exe

O4 - HKLM\..\Run: [Regedit32] H:\WINDOWS\system32\regedit.exe

O4 - HKLM\..\Run: [servises] H:\WINDOWS\system32\servises.exe

O4 - HKCU\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] "H:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [DAEMON Tools] "H:\Arquivos de programas\DAEMON Tools\daemon.exe"

O4 - HKCU\..\Run: [EPSON Stylus C43 Series] H:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S08IC1.EXE /P23 "EPSON Stylus C43 Series" /M "Stylus C43"

O4 - HKCU\..\Run: [Google Update] "H:\Documents and Settings\usuario\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [swg] "H:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [servises] H:\WINDOWS\system32\servises.exe

O4 - HKLM\..\Policies\Explorer\Run: [servises] H:\WINDOWS\system32\servises.exe

O4 - HKCU\..\Policies\Explorer\Run: [servises] H:\WINDOWS\system32\servises.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [systemprofile] H:\WINDOWS\system32\config\systemprofile\systemprofile.exe /i (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [servises] H:\WINDOWS\system32\servises.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [systemprofile] H:\WINDOWS\system32\config\systemprofile\systemprofile.exe /i (User 'Default user')

O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [servises] H:\WINDOWS\system32\servises.exe (User 'Default user')

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://H:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Arquivos de programas\Java\jre1.5.0_12\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Arquivos de programas\Java\jre1.5.0_12\bin\ssv.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - H:\Arquivos de programas\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - H:\Arquivos de programas\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Arquivos de programas\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: h:\windows\system32\nwprovau.dll

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - H:\Arquivos de programas\AVG\AVG8\avgpp.dll

O20 - Winlogon Notify: avgrsstarter - H:\WINDOWS\SYSTEM32\avgrsstx.dll

O23 - Service: avast!UpdateAgent.exe - Unknown owner - H:\WINDOWS\System32\avast!UpdateAgent.exe

O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - H:\ARQUIV~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - H:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - H:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - H:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

O23 - Service: Google Software Updater (gusvc) - Google - H:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - H:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - H:\Arquivos de programas\Arquivos comuns\Nero\Lib\NMIndexingService.exe

O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - H:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - H:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe

O23 - Service: ServiceLayer - Nokia. - H:\Arquivos de programas\PC Connectivity Solution\ServiceLayer.exe

--

End of file - 9430 bytes

com certeza ainda tem problemas.. o firefox não tá abrindo.. mas não tive tempo pra mexer nele e ver como estão as coisas ainda..

gostaria de saber como proceder..

abraços e já agradeço!

DigRam · Agosto 25, 2009

Boa Noite! ig0rf

<@> Baixe: < > Malwarebytes

<@> Atualize o programa!

<@> Escolha o escaneamento Completo!

<@> Desabilite programas de proteção,ao executar o malwarebytes.

<@> Ps: Para determinadas infecções,a ferramenta pedirá reboot. <-- Confirme!

<@> Procure enviar os ítens detectados para a quarentena,clicando em Remover itens.

<@> Para maiores detalhes: < Link >

<><><><><><><><><><><>

<@> Poste,os relatórios: mbam-log-2009-xx-xx (00-00-00).txt + HijackThis,atualizado.

Abraços!

ig0rf · Agosto 26, 2009

bom dia,

rodei o malwarebytes e eis o log:

===========///=============================

Malwarebytes' Anti-Malware 1.40

Versão do banco de dados: 2551

Windows 5.1.2600 Service Pack 3

26/8/2009 09:09:54

mbam-log-2009-08-26 (09-09-54).txt

Tipo de Verificação: Completa (H:\|)

Objetos verificados: 284058

Tempo decorrido: 2 hour(s), 52 minute(s), 48 second(s)

Processos da Memória infectados: 2

Módulos de Memória Infectados: 0

Chaves do Registro infectadas: 10

Valores do Registro infectados: 7

Ítens do Registro infectados: 0

Pastas infectadas: 7

Arquivos infectados: 26

Processos da Memória infectados:

H:\WINDOWS\system32\6.tmp (Trojan.Agent) -> Unloaded process successfully.

H:\WINDOWS\system32\servises.exe (Trojan.Agent) -> Failed to unload process.

Módulos de Memória Infectados:

(Nenhum ítem malicioso foi detectado)

Chaves do Registro infectadas:

HKEY_CLASSES_ROOT\TypeLib\{dabf362d-d442-4402-9208-ca9ed70dd01e} (Adware.Advantage) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{5ac3a9ef-c0f8-41d4-b4e2-b7cebb794151} (Adware.Advantage) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{862def42-89aa-49fa-ae1f-8a84b1b08a17} (Adware.Advantage) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{f6e4845d-1d13-4bc0-942d-b9191524cc48} (Adware.Advantage) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{602d9049-b4ac-4a25-bf75-a9b54d747cba} (Adware.Advantage) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\urlsearchhook.toolbarurlsearchhook (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\urlsearchhook.toolbarurlsearchhook.1 (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\AGprotect (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\advantage (Adware.Vomba) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Valores do Registro infectados:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\servises (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\servises (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Services\del (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\servises (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\servises (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\servises (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\servises (Trojan.Agent) -> Quarantined and deleted successfully.

Ítens do Registro infectados:

(Nenhum ítem malicioso foi detectado)

Pastas infectadas:

H:\Arquivos de programas\Advantage (Adware.Advantage) -> Quarantined and deleted successfully.

H:\Arquivos de programas\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302} (Adware.Advantage) -> Quarantined and deleted successfully.

H:\Arquivos de programas\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome (Adware.Advantage) -> Quarantined and deleted successfully.

H:\Arquivos de programas\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content (Adware.Advantage) -> Quarantined and deleted successfully.

H:\Arquivos de programas\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\locale (Adware.Advantage) -> Quarantined and deleted successfully.

H:\Arquivos de programas\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\locale\en-US (Adware.Advantage) -> Quarantined and deleted successfully.

H:\Arquivos de programas\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\components (Adware.Advantage) -> Quarantined and deleted successfully.

Arquivos infectados:

H:\WINDOWS\system32\servises.exe (Trojan.FakeAlert.H) -> Delete on reboot.

H:\Arquivos de programas\Advantage\AdVantage.db (Adware.Advantage) -> Quarantined and deleted successfully.

H:\Arquivos de programas\Advantage\AdVantage.htm (Adware.Advantage) -> Quarantined and deleted successfully.

H:\Arquivos de programas\Advantage\AdVUninst.exe (Adware.Advantage) -> Quarantined and deleted successfully.

H:\Arquivos de programas\Advantage\ffext.mod (Adware.Advantage) -> Quarantined and deleted successfully.

H:\Arquivos de programas\Advantage\TR.dll (Adware.Advantage) -> Quarantined and deleted successfully.

H:\Arquivos de programas\Advantage\user.db (Adware.Advantage) -> Quarantined and deleted successfully.

H:\Arquivos de programas\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome.manifest (Adware.Advantage) -> Quarantined and deleted successfully.

H:\Arquivos de programas\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.js (Adware.Advantage) -> Quarantined and deleted successfully.

H:\Arquivos de programas\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.rdf (Adware.Advantage) -> Quarantined and deleted successfully.

H:\Arquivos de programas\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\vssver2.scc (Adware.Advantage) -> Quarantined and deleted successfully.

H:\Arquivos de programas\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\advantage.png (Adware.Advantage) -> Quarantined and deleted successfully.

H:\Arquivos de programas\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\contents.rdf (Adware.Advantage) -> Quarantined and deleted successfully.

H:\Arquivos de programas\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\overlay.js (Adware.Advantage) -> Quarantined and deleted successfully.

H:\Arquivos de programas\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\overlay.xul (Adware.Advantage) -> Quarantined and deleted successfully.

H:\Arquivos de programas\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\vssver2.scc (Adware.Advantage) -> Quarantined and deleted successfully.

H:\Arquivos de programas\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\locale\en-US\overlay.dtd (Adware.Advantage) -> Quarantined and deleted successfully.

H:\Arquivos de programas\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\locale\en-US\vssver2.scc (Adware.Advantage) -> Quarantined and deleted successfully.

H:\Arquivos de programas\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\IMeMedia_FF.xpt (Adware.Advantage) -> Quarantined and deleted successfully.

H:\Arquivos de programas\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\MeMedia_FF.dll (Adware.Advantage) -> Quarantined and deleted successfully.

H:\WINDOWS\system32\reader_s.exe (Trojan.Agent) -> Quarantined and deleted successfully.

H:\WINDOWS\system32\3.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

H:\WINDOWS\system32\6.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

H:\WINDOWS\system32\7.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

H:\install.exe (Trojan.Agent) -> Quarantined and deleted successfully.

H:\Documents and Settings\usuario\oashdihasidhasuidhiasdhiashdiuasdhasd (Trace.Pandex) -> Quarantined and deleted successfully.

==================//==========================================

aí ele pediu pra reiniciar pra terminar de remover os arquivos infectados...

eis que eu reinicio o PC e ele dá o mesmo problema de antes... simplesmente não inicializa o windows pois o userinit.exe tá bichado.. essa é a mensagem que aparece após eu tentar fazer o logon:

Alerta de Prevenção de execução de dados - Microsoft Windows

Para ajudar a proteger seu computador, o Windows fechou este progama.

Nome: Aplicativo de logon userinit

Editor: Microsoft Corporation

[Fechar Mensagem]

=======================//=================================

novamente sem conseguir ligar o pc em modo normal, liguei em modo de segurança e rodei o hijackthis, eis o log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 09:31:57, on 26/8/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Safe mode with network support

Running processes:

H:\WINDOWS\System32\smss.exe

H:\WINDOWS\system32\winlogon.exe

H:\WINDOWS\system32\services.exe

H:\WINDOWS\system32\lsass.exe

H:\WINDOWS\system32\svchost.exe

H:\WINDOWS\Explorer.EXE

H:\WINDOWS\system32\svchost.exe

H:\WINDOWS\system32\4.tmp

H:\WINDOWS\System32\reader_s.exe