[Resolvido!] remover Cavalo de Tróia Generic 14.beleza

Cristiane F. · Outubro 16, 2009

Oi Oi!!

Estou precisando muito da preciosa ajuda de vocês, sou usuária sem muita experiência em remoção de vírus. Meu PC foi infectado na semana passada com um spyware que criava falsos pop-ups solicitando atualização de um suposto antivírus "Windows Pro 2009", que nem mesmo tenho no meu computador.

Meu anti-vírus acusou a presença de lizkavd.exe/svcst.exe e seres.exe. Segui um procedimento que encontrei num tópico daqui, pois a pessoa tinha extamente o mesmo problema, que havia sido solucionado. Instalei o Malware Bytes e o executei, ele acusou diversas entradas, que foram todas colocadas em quarentena e então removidas. Segui também as instruções para estabelecer um ponto limpo na restauração do sistema. Aparentemente, tinha funcionado bem, os falso pop-ups tinham desaparecido e os arquivos lizkavd.exe/svcst.exe e seres.exe também tinham sumido da pasta documents and settings/usuário/dados de aplicativos.Tudo parecia normal, porém, ao fazer novo scan com meu anti-vírus AVG, ele acusa a presença de um Cavalo de Troia Generic 14.BLZO, que não consegue remover por fazer parte de um arquivo crítico do sistema (arquivo C:\windows\system32\drivers\agp440.sys).

Segue aqui o meu log no Hijackthis para sua análise:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 09:56:57, on 16/10/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Arquivos de Programas\CyberLink\PowerDVD\DVDLauncher.exe

C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe

C:\Arquivos de programas\HP\hpcoretech\hpcmpmgr.exe

C:\Arquivos de programas\Analog Devices\Core\smax4pnp.exe

C:\WINDOWS\system32\eTCrtMng.exe

C:\WINDOWS\system32\aetcrss1.exe

C:\Arquivos de programas\Yahoo!\Search Protection\SearchProtection.exe

C:\Arquivos de programas\Datakey\Crypt32\DkAutoReg.exe

C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe

C:\Arquivos de programas\Java\jre6\bin\jusched.exe

C:\ARQUIV~1\AVG\AVG8\avgtray.exe

C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\system32\ctfmon.exe

C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

C:\WINDOWS\System32\DkLog.exe

C:\WINDOWS\system32\dkvcm.exe

C:\Arquivos de programas\Skype\Phone\Skype.exe

C:\WINDOWS\system32\eTSrv.exe

C:\Arquivos de programas\Dell\OpenManage\Client\Iap.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\dkcktkn.exe

C:\ARQUIV~1\AVG\AVG8\avgrsx.exe

C:\ARQUIV~1\AVG\AVG8\avgnsx.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

C:\Arquivos de programas\Windows Desktop Search\WindowsSearch.exe

C:\Arquivos de programas\Microsoft Office\Office12\ONENOTEM.EXE

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqgalry.exe

C:\Arquivos de programas\Skype\Plugin Manager\skypePM.exe

C:\Arquivos de programas\Microsoft Office\Office12\OUTLOOK.EXE

C:\Arquivos de programas\AVG\AVG8\avgcsrvx.exe

C:\Arquivos de programas\Java\jre6\bin\jucheck.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\Arquivos de programas\HiJackThis.exe

C:\Arquivos de programas\AVG\AVG8\avgcsrvx.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www1.la.dell.com/content/default.aspx?c=br&l=pt&s=gen

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\ARQUIV~1\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\ARQUIV~1\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG8\avgssie.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Arquivos de programas\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\ARQUIV~1\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [DVDLauncher] "C:\Arquivos de Programas\CyberLink\PowerDVD\DVDLauncher.exe"

O4 - HKLM\..\Run: [TkBellExe] "C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe

O4 - HKLM\..\Run: [HP Component Manager] "C:\Arquivos de programas\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [soundMAXPnP] C:\Arquivos de programas\Analog Devices\Core\smax4pnp.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [eTCertManger] C:\WINDOWS\system32\eTCrtMng.exe

O4 - HKLM\..\Run: [gemstrmw] C:\WINDOWS\system32\gemstrmw.exe /r

O4 - HKLM\..\Run: [CertificateRegistration] aetcrss1.exe

O4 - HKLM\..\Run: [YSearchProtection] "C:\Arquivos de programas\Yahoo!\Search Protection\SearchProtection.exe"

O4 - HKLM\..\Run: [DkAutoReg.exe] C:\Arquivos de programas\Datakey\Crypt32\DkAutoReg.exe

O4 - HKLM\..\Run: [DkMonitor.exe] C:\Arquivos de programas\Datakey\Crypt32\DkMonitor.exe

O4 - HKLM\..\Run: [DkStartup] C:\Arquivos de programas\Datakey\Crypt32\DkStartup.exe

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [restorer64_a] C:\WINDOWS\system32\restorer64_a.exe

O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARQUIV~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Arquivos de programas\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKLM\..\Run: [HP Software Update] C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime

O4 - HKCU\..\Run: [skype] "C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [updateMgr] "C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1

O4 - HKCU\..\Run: [swg] "C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [YSearchProtection] C:\Arquivos de programas\Yahoo!\Search Protection\SearchProtection.exe

O4 - HKCU\..\Run: [search Protection] C:\Arquivos de programas\Yahoo!\Search Protection\SearchProtection.exe

O4 - HKCU\..\Run: [restorer64_a] C:\Documents and Settings\cfantinati\restorer64_a.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Arquivos de programas\Microsoft Office\Office12\ONENOTEM.EXE

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Inicialização rápida do HP Image Zone.lnk = C:\Arquivos de programas\HP\Digital Imaging\bin\hpqthb08.exe

O4 - Global Startup: Windows Desktop Search.lnk = C:\Arquivos de programas\Windows Desktop Search\WindowsSearch.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: SmartLogon - {2E0DB803-2B3E-44C5-8D69-74300D3A73AE} - C:\Arquivos de programas\Datakey\Crypt32\DkSmartLogonExtension.dll

O9 - Extra 'Tools' menuitem: SmartLogon - {2E0DB803-2B3E-44C5-8D69-74300D3A73AE} - C:\Arquivos de programas\Datakey\Crypt32\DkSmartLogonExtension.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Arquivos de programas\AVG\AVG8\avgpp.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O20 - Winlogon Notify: DkWLNP - C:\WINDOWS\SYSTEM32\DkWLNP.dll

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Datakey's Log Service (DkLogger) - Datakey, Inc. - C:\WINDOWS\System32\DkLog.exe

O23 - Service: Datakey's Token Service (DkTknSrv) - Datakey, Inc. - C:\WINDOWS\System32\dkcktkn.exe

O23 - Service: Datakey's Virtual Channel Monitor (DkVcm) - Datakey, Inc. - C:\WINDOWS\system32\dkvcm.exe

O23 - Service: eToken Notification Service (ETOKSRV) - Aladdin Knowledge Systems, Ltd. - C:\WINDOWS\system32\eTSrv.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Iap - Dell Inc - C:\Arquivos de programas\Dell\OpenManage\Client\Iap.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--

End of file - 12096 bytes

Aqui o log do Malware Bytes:

Malwarebytes' Anti-Malware 1.41

Versão do banco de dados: 2968

Windows 5.1.2600 Service Pack 3

16/10/2009 09:02:58

mbam-log-2009-10-16 (09-02-58).txt

Tipo de Verificação: Completa (C:\|)

Objetos verificados: 195246

Tempo decorrido: 1 hour(s), 16 minute(s), 34 second(s)

Processos da Memória infectados: 0

Módulos de Memória Infectados: 0

Chaves do Registro infectadas: 0

Valores do Registro infectados: 0

Ítens do Registro infectados: 0

Pastas infectadas: 0

Arquivos infectados: 0

Processos da Memória infectados:

(Nenhum ítem malicioso foi detectado)

Módulos de Memória Infectados:

(Nenhum ítem malicioso foi detectado)

Chaves do Registro infectadas:

(Nenhum ítem malicioso foi detectado)

Valores do Registro infectados:

(Nenhum ítem malicioso foi detectado)

Ítens do Registro infectados:

(Nenhum ítem malicioso foi detectado)

O que será que está acontecendo??

Desde já agradeço imensamente!

Cris

Power Max · Outubro 16, 2009

:thumbsup: Oi Cristiane! Seja bem-vinda ao Fórum Imasters.

:seta: Sugiro que você salve ou imprima essas instruções abaixo, pois em alguns momentos você poderá precisar usar o computador sem o acesso à internet:

• Faça o download do Superantispyware;

• Dê um duplo clique no ícone do programa e instale-o clicando em (Next > Aceite o contrato > Next > Next > escolha a opção de salvá-lo na pasta de Arquivos de Programas > Next > Next > aguarde a instalação > clique no botão Finish.

• Aparecerá uma caixa pedindo para que seja escolhida o seu idioma, escolha a opção de Portuguese (BR) e clique no botão Ok.

• Aparecerá uma mensagem perguntando: “Você quer que o SUPERAntiSpyware procure as regras e definições atuais agora (Recomendado)? Conecte o computador à Internet e clique no botão Sim. Aguarde a sua atualização

• Surgirá mais uma tela, clique no botão Avançar > – Avançar > – Avançar > - Avançar > – Concluir.

• Aparecerá uma janela perguntando se você deseja proteger a sua página inicial do Internet Explorer contra mudanças. Escolha a opção desejada.

• Reinicie o computador,em Modo de Segurança (apertando a tecla F8 (ou a tecla F5 em alguns computadores) repetidas vezes quando o computador estiver reiniciando e escolhendo a opção Modo Seguro ou Modo de Segurança);

• Caso não seja possível reiniciar o computador em Modo de segurança, faça o escaneamento no modo normal.

• Execute o SuperAntispyware e clique em: Escaneia seu PC...

• Em Local de escaneamento escolha: C:\ Fixed Drive ( NTFS ) e se você tiver outros discos a serem escaneados marque-os também;

• Marque a opção Faz Escaneamento Completo;

• Clique em Avançar. Aguarde!

• Terminando,abrir-se-à a janela: Resumo de Escaneamento SUPERAntiSpyware. Clique no botão Ok. Clique no botão Avançar > para que as ameaças sejam excluídas.

• Poderá aparecer uma mensagem perguntando se você deseja que o computador seja reiniciado para que os itens sejam excluídos. Clique em Sim.

• Após o reinício do PC, clique com o botão direito do mouse sobre o ícone do SUPERAntiSpyware ao lado do relógio do Windows e escolha a opção – Ver Centro de Controle (Preferências/Opções)... – clique na aba: Estatísticas/Arquivos de Log - Dê um duplo clique com o botão esquerdo do mouse sobre o log e será aberta uma tela com o log, então é só selecionar este Log (Clique no menu: Editar » Selecionar Tudo), depois disso volte novamente no menu: Editar » e clique na opção: Copiar).

• Depois disso é só voltar aqui no fórum e postar este log do SUPERAntiSpyware juntamente com um novo log do Hijackthis para que eles possam ser analizados e nos diga se todos os problemas encontrados pelo SuperAntispyware foram removidos.

• Ficamos no aguardo.

Cristiane F. · Outubro 19, 2009

Oi Oi Antonio,

Muito obrigada pelo passo a passo tão detalhado :thumbsup: !

Vamos aos logs então.

Do Superantispyware:

SUPERAntiSpyware Scan Log

http://www.superantispyware.com

Generated 10/19/2009 at 01:14 PM

Application Version : 4.29.1004

Core Rules Database Version : 4173

Trace Rules Database Version: 2093

Scan type : Complete Scan

Total Scan Time : 01:12:57

Memory items scanned : 234

Memory threats detected : 0

Registry items scanned : 6523

Registry threats detected : 0

File items scanned : 23214

File threats detected : 161

Adware.Tracking Cookie

C:\Documents and Settings\cfantinati\Cookies\cfantinati@adservingml[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@adtech[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@tns-counter[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@www.hairfinder[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@adserver-2.bnetwork.com[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@server.iad.liveperson[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@sixapart.adbureau[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@statcounter[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@overture[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@ads.clicksor[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@fortuneopub.solution.weborama[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@oas.adservingml[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@ads.buscape.com[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@msnportal.112.2o7[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@xiti[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@sistema.allinmedia.com[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@adinterax[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@ad.zanox[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@eas.apm.emediate[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@hairfinder[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@myroitracking[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@trvlnet.adbureau[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@fl01.ct2.comclick[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@amilportal.ad.adnetwork.com[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@zbox.zanox[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@advertising[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@99counters[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@rambler[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@m1.webstats.motigo[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@ads.realmedia.com[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@tscounter[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@abril.112.2o7[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@ice.112.2o7[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@apmebf[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@ads.sun[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@specificmedia[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@realmedia[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@a1.interclick[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@ads.abril.com[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@76959217[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@ad.adnetwork.com[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@specificclick[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@ad.yieldmanager[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@ads.viddler[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@atlanticahotels.ad.adnetwork.com[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@atdmt[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@tam.ad.adnetwork.com[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@ads.us.e-planning[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@ads.bolsademulher[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@list[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@ads.directaclick[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@tribalfusion[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@adsense2008.mpl[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@doubleclick[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@adbrite[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@serving-sys[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@roiservice[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@richmedia.yahoo[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@ads.bluelithium[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@himidia.112.2o7[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@ads.twenga[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@chitika[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@snap9.advertserve[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@boursoramabanque.solution.weborama[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@24631554[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@portalclaro.ad.adnetwork.com[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@ads.hardmob.com[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@trafficmp[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@walmartbrasil.112.2o7[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@please[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@bravenet[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@ads1.mediaops.com[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@smartadserver[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@statse.webtrendslive[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@stats.adbrite[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@interclick[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@revsci[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@videoegg.adbureau[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@b2wviagens.122.2o7[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@kontera[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@weborama[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@azul.ad.adnetwork.com[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@ad.virgula.com[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@visiteurope[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@aunica.112.2o7[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@questionmarket[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@paypal.112.2o7[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@ad2.pop.com[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@millenniumhotels.122.2o7[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@52829327[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@msnbc.112.2o7[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@cdn4.specificclick[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@adopt.specificclick[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@trackalyzer[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@service.liveperson[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@ak[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@yadro[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@ads.sapo[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@golalmap.ad.adnetwork.com[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@stats.jollypeople[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@www.imediaexcellence.com[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@1042569231[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@ads.minhavida.com[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@sulamerica.ad.adnetwork.com[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@deloitte.122.2o7[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@1069390747[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@content.yieldmanager[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@adserver.internet-arts[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@ads.pugetsoundsoftware[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@bs.serving-sys[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@stats1.clicktracks[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@1033633648[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@ads.xpg.com[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@1035911751[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@stat.blogorama[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@adserver.jacotei.com[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@at.atwola[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@tacoda[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@008.free-counters.co[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@1066419315[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@oasc05.247realmedia[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@1055809208[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@cgi-bin[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@loreal.ad.adnetwork.com[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@adserver.dialhost.com[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@perf.overture[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@avgtechnologies.112.2o7[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@1072707600[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@1059546366[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@ads.as4x.tmcs.ticketmaster[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@claroideias.ad.adnetwork.com[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@1060637718[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@1068000933[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@1044263752[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@ads.clubedohardware.com[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@contoursexpress.com[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@1066977303[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@fastclick[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@tripod[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@skyac.ad.adnetwork.com[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@link.mercent[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@e-2dj6wml4okcjghq.stats.esomniture[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@pro-market[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@1068758887[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@semdirector.112.2o7[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@19452074[2].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@media.realmedia.com[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@1071095996[1].txt

C:\Documents and Settings\Administrator\Cookies\administrator@ehg-extreme.hitbox[1].txt

C:\Documents and Settings\cfantinati\Configurações locais\Temp\Cookies\cfantinati@server.iad.liveperson[2].txt

C:\Documents and Settings\cfantinati\Configurações locais\Temp\Cookies\cfantinati@ads.obaoba.com[1].txt

C:\Documents and Settings\cfantinati\Configurações locais\Temp\Cookies\cfantinati@ads1.mediaops.com[1].txt

C:\Documents and Settings\cfantinati\Configurações locais\Temp\Cookies\cfantinati@stats.guiamais.com[1].txt

C:\Documents and Settings\cfantinati\Configurações locais\Temp\Cookies\cfantinati@banner.tpi.com[1].txt

C:\Documents and Settings\cfantinati\Configurações locais\Temp\Cookies\cfantinati@tam.ad.adnetwork.com[2].txt

C:\Documents and Settings\cfantinati\Configurações locais\Temp\Cookies\cfantinati@ad.adnetwork.com[1].txt

C:\Documents and Settings\cfantinati\Configurações locais\Temp\Cookies\cfantinati@ads.abril.com[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@neocounter2[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@accounts[1].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@accounts[3].txt

C:\Documents and Settings\cfantinati\Cookies\cfantinati@accounts[4].txt

E para o meu desespero, quando eu fui fazer o scan no Hijackthis, o AVG novamente acusou o vírus Cavalo de Tróia 14.blzo no C:\\windows/system32\drivers\agp440.sys. De qualquer forma, segue o log do Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 13:25:32, on 19/10/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Arquivos de Programas\CyberLink\PowerDVD\DVDLauncher.exe

C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe

C:\Arquivos de programas\HP\hpcoretech\hpcmpmgr.exe

C:\Arquivos de programas\Analog Devices\Core\smax4pnp.exe

C:\WINDOWS\system32\eTCrtMng.exe

C:\WINDOWS\system32\aetcrss1.exe

C:\Arquivos de programas\Yahoo!\Search Protection\SearchProtection.exe

C:\Arquivos de programas\Datakey\Crypt32\DkAutoReg.exe

C:\Arquivos de programas\Datakey\Crypt32\DkMonitor.exe

C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe

C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

C:\ARQUIV~1\AVG\AVG8\avgtray.exe

C:\WINDOWS\System32\DkLog.exe

C:\WINDOWS\system32\dkvcm.exe

C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\system32\eTSrv.exe

C:\Arquivos de programas\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Dell\OpenManage\Client\Iap.exe

C:\Arquivos de programas\Skype\Phone\Skype.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

C:\ARQUIV~1\AVG\AVG8\avgrsx.exe

C:\Arquivos de programas\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\ARQUIV~1\AVG\AVG8\avgnsx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\dkcktkn.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

C:\Arquivos de programas\Microsoft Office\Office12\ONENOTEM.EXE

C:\WINDOWS\system32\SearchIndexer.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqgalry.exe

C:\Arquivos de programas\Skype\Plugin Manager\skypePM.exe

C:\WINDOWS\system32\notepad.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\SearchProtocolHost.exe