[Resolvido!] " Your computer is efected ! "

monicasilva22 · Outubro 2, 2009

JA TENTEI PELO SMITFRAUDFIX E NUM DEU EM NADA =\

este éo meu log :

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:01:59, on 1/10/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\ARQUIV~1\GbPlugin\GbpSv.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\InCD.exe

C:\WINDOWS\system32\rundll32.exe

C:\Arquivos de programas\ScanSoft\OmniPageSE4.0\OpwareSE4.exe

C:\WINDOWS\Temp\wpv421254042811.exe

C:\WINDOWS\system32\restorer32_a.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe

C:\Arquivos de programas\Ares\Ares.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Skype\Phone\Skype.exe

C:\WINDOWS\system32\svchost.exe

C:\Documents and Settings\user\Dados de aplicativos\seres.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

C:\ARQUIV~1\MICROS~2\MSSQL\binn\sqlservr.exe

C:\Documents and Settings\user\Dados de aplicativos\svcst.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Microsoft Office\Office12\ONENOTEM.EXE

C:\WINDOWS\system32\PnkBstrA.exe

C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\System32\alg.exe

C:\Arquivos de programas\Skype\Plugin Manager\skypePM.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\Documents and Settings\user\Desktop\HijackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wsnpoema.exe,

O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Arquivos de programas\Canon\Easy-WebPrint\EWPBrowseLoader.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\Arquivos de programas\GbPlugin\gbiehcef.dll

O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Arquivos de programas\Canon\Easy-WebPrint\Toolband.dll

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [RemoteControl] "C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [LanguageShortcut] "C:\Arquivos de programas\CyberLink\PowerDVD\Language\Language.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [securDisc] C:\Arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe

O4 - HKLM\..\Run: [inCD] C:\Arquivos de programas\Nero\Nero 7\InCD\InCD.exe

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [sSBkgdUpdate] "C:\Arquivos de programas\Arquivos comuns\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [OpwareSE4] "C:\Arquivos de programas\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"

O4 - HKLM\..\Run: [sysgif32] C:\WINDOWS\Temp\wpv421254042811.exe

O4 - HKLM\..\Run: [restorer32_a] C:\WINDOWS\system32\restorer32_a.exe

O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [ares] "C:\Arquivos de programas\Ares\Ares.exe" -h

O4 - HKCU\..\Run: [skype] "C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [restorer32_a] C:\Documents and Settings\user\restorer32_a.exe

O4 - HKCU\..\Run: [mserv] C:\Documents and Settings\user\Dados de aplicativos\seres.exe

O4 - HKCU\..\Run: [svchost] C:\Documents and Settings\user\Dados de aplicativos\svcst.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Recorte de tela e Iniciador do OneNote 2007.lnk = C:\Arquivos de programas\Microsoft Office\Office12\ONENOTEM.EXE

O4 - Global Startup: Service Manager.lnk = C:\Arquivos de programas\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~3\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Arquivos de programas\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html

O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Arquivos de programas\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Arquivos de programas\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html

O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Arquivos de programas\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~3\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} (GbpDistObj Class) - https://imagem.caixa.gov.br/cab/gbpdist.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: GbPluginCef - C:\Arquivos de programas\GbPlugin\gbiehcef.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Gbp Service (GbpSv) - - C:\ARQUIV~1\GbPlugin\GbpSv.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

--

End of file - 10063 bytes

AGRADEÇIDAA DESDE JAH !

DigRam · Outubro 2, 2009

Boa Noite! monicasilva22

<@> Baixe: < > Malwarebytes

<@> < Link - 2 >

<@> < Link - 3 >

<@> Atualize o programa!

<@> Escolha o escaneamento Completo!

<@> Desabilite programas de proteção,ao executar o malwarebytes.

<@> Ps: Para determinadas infecções,a ferramenta pedirá reboot. <-- Confirme!

<@> Procure enviar os ítens detectados para a quarentena,clicando em Remover itens.

<@> Para maiores detalhes: < Link >

<><><><><><><><><><><>

<@> Poste,os relatórios: mbam-log-2009-xx-xx (00-00-00).txt + HijackThis,atualizado.

Abraços!

monicasilva22 · Outubro 2, 2009

NOSSA MUITO OBRIGADA !!

DEU CERTO !! SUMIO AQUELE NEGOCIO CHATO ! HEHE

E AGORA QUE ELES ESTAO NA QUARENTENA ? DEVO REMOVER TUDO ? OU NÃO ?

DEIXO O PROGRAMA NO PC OU EXCLUO ?

AQUI ESTA O MBAM-LOG:

Malwarebytes' Anti-Malware 1.41

Versão do banco de dados: 2895

Windows 5.1.2600 Service Pack 3

2/10/2009 14:12:43 Jão sz Moh

mbam-log-2009-10-02 (14-12-43).txt

Tipo de Verificação: Completa (C:\|)

Objetos verificados: 185229

Tempo decorrido: 37 minute(s), 15 second(s)

Processos da Memória infectados: 7

Módulos de Memória Infectados: 0

Chaves do Registro infectadas: 0

Valores do Registro infectados: 6

Ítens do Registro infectados: 3

Pastas infectadas: 2

Arquivos infectados: 64

Processos da Memória infectados:

C:\WINDOWS\Temp\wpv421254042811.exe (Trojan.Proxy) -> Unloaded process successfully.

C:\Documents and Settings\Convidado\Dados de aplicativos\seres.exe (Trojan.Agent) -> Unloaded process successfully.

C:\Documents and Settings\user\Dados de aplicativos\seres.exe (Trojan.Agent) -> Unloaded process successfully.

C:\Documents and Settings\Convidado\Dados de aplicativos\svcst.exe (Trojan.Agent) -> Unloaded process successfully.

C:\Documents and Settings\user\Dados de aplicativos\svcst.exe (Trojan.Agent) -> Unloaded process successfully.

C:\WINDOWS\system32\restorer32_a.exe (Trojan.FakeAlert) -> Unloaded process successfully.

C:\WINDOWS\system32\wsnpoema.exe (Trojan.Agent) -> Unloaded process successfully.

Módulos de Memória Infectados:

(Nenhum ítem malicioso foi detectado)

Chaves do Registro infectadas:

(Nenhum ítem malicioso foi detectado)

Valores do Registro infectados:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysgif32 (Trojan.Proxy) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mserv (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\restorer32_a (Trojan.FakeAlert) -> Delete on reboot.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\restorer32_a (Trojan.FakeAlert) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Regedit32 (Trojan.Agent) -> Delete on reboot.

Ítens do Registro infectados:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\wsnpoema.exe -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\wsnpoema.exe -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wsnpoema.exe,) Good: (Userinit.exe) -> Quarantined and deleted successfully.

Pastas infectadas:

C:\WINDOWS\system32\wsnpoema (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Convidado\Menu Iniciar\Programas\AntivirusPro_2010 (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.

Arquivos infectados:

C:\WINDOWS\Temp\wpv421254042811.exe (Trojan.Proxy) -> Quarantined and deleted successfully.

C:\Arquivos de programas\Native Instruments\Battery 2\UNWISE.EXE (Malware.Packer.Morphine) -> Quarantined and deleted successfully.

C:\Documents and Settings\Convidado\Configurações locais\Temporary Internet Files\Content.IE5\81UHG1CX\Install[1].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Convidado\Dados de aplicativos\lizkavd.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\user\Configurações locais\Temporary Internet Files\Content.IE5\T901WZ9X\Install[1].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\user\Dados de aplicativos\lizkavd.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{88B6001B-B3F8-45CC-AED9-B9087D281502}\RP167\A0164803.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{88B6001B-B3F8-45CC-AED9-B9087D281502}\RP167\A0164811.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{88B6001B-B3F8-45CC-AED9-B9087D281502}\RP167\A0164880.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{88B6001B-B3F8-45CC-AED9-B9087D281502}\RP167\A0164881.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{88B6001B-B3F8-45CC-AED9-B9087D281502}\RP167\A0164812.cpl (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{88B6001B-B3F8-45CC-AED9-B9087D281502}\RP167\A0164915.exe (Trojan.Backdoor) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{88B6001B-B3F8-45CC-AED9-B9087D281502}\RP167\A0164917.exe (Trojan.Backdoor) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{88B6001B-B3F8-45CC-AED9-B9087D281502}\RP167\A0164982.exe (Trojan.Backdoor) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{88B6001B-B3F8-45CC-AED9-B9087D281502}\RP167\A0166010.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{88B6001B-B3F8-45CC-AED9-B9087D281502}\RP167\A0167010.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{88B6001B-B3F8-45CC-AED9-B9087D281502}\RP167\A0168010.exe (Trojan.Bredolab) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{88B6001B-B3F8-45CC-AED9-B9087D281502}\RP167\A0168402.cpl (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{88B6001B-B3F8-45CC-AED9-B9087D281502}\RP167\A0170589.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{88B6001B-B3F8-45CC-AED9-B9087D281502}\RP167\A0171627.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{88B6001B-B3F8-45CC-AED9-B9087D281502}\RP167\A0171628.dll (Adware.XPSecurityCenter) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{88B6001B-B3F8-45CC-AED9-B9087D281502}\RP167\A0171635.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{88B6001B-B3F8-45CC-AED9-B9087D281502}\RP167\A0171636.cpl (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{88B6001B-B3F8-45CC-AED9-B9087D281502}\RP167\A0172625.cpl (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{88B6001B-B3F8-45CC-AED9-B9087D281502}\RP169\A0172739.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{88B6001B-B3F8-45CC-AED9-B9087D281502}\RP169\A0172740.dll (Adware.XPSecurityCenter) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{88B6001B-B3F8-45CC-AED9-B9087D281502}\RP169\A0172747.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{88B6001B-B3F8-45CC-AED9-B9087D281502}\RP169\A0172748.cpl (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{88B6001B-B3F8-45CC-AED9-B9087D281502}\RP169\A0172756.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{88B6001B-B3F8-45CC-AED9-B9087D281502}\RP169\A0172772.cpl (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{88B6001B-B3F8-45CC-AED9-B9087D281502}\RP169\A0173801.cpl (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\tftp.nfo (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\wsnpoema\audio.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\wsnpoema\video.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Convidado\Menu Iniciar\Programas\AntivirusPro_2010\AntivirusPro_2010.lnk (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.

C:\Documents and Settings\Convidado\Menu Iniciar\Programas\AntivirusPro_2010\Uninstall.lnk (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.

C:\Documents and Settings\Convidado\Dados de aplicativos\seres.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\user\Dados de aplicativos\seres.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Convidado\Dados de aplicativos\svcst.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\user\Dados de aplicativos\svcst.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\restorer32_a.exe (Trojan.FakeAlert) -> Delete on reboot.

C:\Documents and Settings\user\Dados de aplicativos\wiaserva.log (Malware.Trace) -> Quarantined and deleted successfully.

C:\Documents and Settings\user\Dados de aplicativos\wiaservg.log (Malware.Trace) -> Quarantined and deleted successfully.

C:\autorun.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\wsnpoema.exe (Trojan.Agent) -> Delete on reboot.

C:\Documents and Settings\Convidado\Configurações locais\Temp\BN1.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\user\Configurações locais\Temp\BN1.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Convidado\Configurações locais\Temp\BN2.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\user\Configurações locais\Temp\BN2.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\user\Configurações locais\Temp\BN3.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\user\Configurações locais\Temp\BN4.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Convidado\Configurações locais\Temp\tmpwr2 (Rogue.Installer) -> Quarantined and deleted successfully.

C:\Documents and Settings\user\Configurações locais\Temp\tmpwr2 (Rogue.Installer) -> Quarantined and deleted successfully.

C:\Documents and Settings\user\Configurações locais\Temp\tmpwr3 (Rogue.Installer) -> Quarantined and deleted successfully.

C:\Documents and Settings\user\Configurações locais\Temp\tmpwr4 (Rogue.Installer) -> Quarantined and deleted successfully.

C:\Documents and Settings\user\Configurações locais\Temp\tmpwr5 (Rogue.Installer) -> Quarantined and deleted successfully.

C:\Documents and Settings\user\Configurações locais\Temp\tmpwr6 (Rogue.Installer) -> Quarantined and deleted successfully.

C:\Documents and Settings\user\Configurações locais\Temp\tmpwr7 (Rogue.Installer) -> Quarantined and deleted successfully.

C:\Documents and Settings\user\Configurações locais\Temp\tmpwr8 (Rogue.Installer) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\wpv281253926400.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Convidado\oashdihasidhasuidhiasdhiashdiuasdhasd (Malware.Trace) -> Quarantined and deleted successfully.

C:\Documents and Settings\user\oashdihasidhasuidhiasdhiashdiuasdhasd (Malware.Trace) -> Quarantined and deleted successfully.

C:\Documents and Settings\Convidado\Desktop\AntivirusPro_2010.lnk (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.

C:\Documents and Settings\Convidado\Dados de aplicativos\Microsoft\Internet Explorer\Quick Launch\AntivirusPro_2010.lnk (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.

E O LOG DO HIJACKTHIS :

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 14:24:42, on 2/10/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\ARQUIV~1\GbPlugin\GbpSv.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\InCD.exe

C:\WINDOWS\system32\rundll32.exe

C:\Arquivos de programas\ScanSoft\OmniPageSE4.0\OpwareSE4.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\Arquivos de programas\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe

C:\Arquivos de programas\Ares\Ares.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\ARQUIV~1\MICROS~2\MSSQL\binn\sqlservr.exe

C:\Arquivos de programas\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

C:\Arquivos de programas\Microsoft Office\Office12\ONENOTEM.EXE

C:\WINDOWS\system32\PnkBstrA.exe

C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\Documents and Settings\user\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Arquivos de programas\Canon\Easy-WebPrint\EWPBrowseLoader.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\Arquivos de programas\GbPlugin\gbiehcef.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll