[Resolvido!] PC lento - log do HijackThis

francisnei · Dezembro 6, 2009

Creio q meu computador esta com vírus, esta muito lento, segue abaixo o log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:22:57, on 6/12/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16915)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\ARQUIV~1\GbPlugin\GbpSv.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

c:\arquivos de programas\arquivos comuns\logishrd\lvmvfm\LVPrcSrv.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\HPZipm12.exe

C:\Arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Arquivos de programas\Java\jre6\bin\jusched.exe

C:\Arquivos de programas\Arquivos comuns\LogiShrd\LComMgr\Communications_Helper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe

C:\Arquivos de programas\BrOffice.org 3\program\soffice.exe

C:\Arquivos de programas\BrOffice.org 3\program\soffice.bin

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\System32\alg.exe

C:\Arquivos de programas\Mozilla Firefox 3.6 Beta 1\firefox.exe

C:\Spyware Cleaner 2009 V3.04\SpywareCleaner.exe

C:\Spyware Cleaner 2009 V3.04\RnScan.exe

C:\Documents and Settings\Administrador\Desktop\HiJackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mastertur.com.br/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\syslsass.exe,

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Arquivos de programas\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\ARQUIV~1\GBPLUGIN\gbieh.dll

O2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\Arquivos de programas\GbPlugin\gbiehcef.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [ToolBoxFX] "C:\Arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /systrayIcon:on /fl:on /fr:on /appData:on

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Arquivos de programas\Arquivos comuns\LogiShrd\LComMgr\Communications_Helper.exe"

O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Arquivos de programas\Logitech\QuickCam\Quickcam.exe" /hide

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKLM\..\Run: [userFaultCheck] %systemroot%\system32\dumprep 0 -u

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - S-1-5-18 Startup: Secunia PSI.lnk = C:\Arquivos de programas\Secunia\PSI\psi.exe (User 'SYSTEM')

O4 - .DEFAULT Startup: Secunia PSI.lnk = C:\Arquivos de programas\Secunia\PSI\psi.exe (User 'Default user')

O4 - Startup: Secunia PSI.lnk = C:\Arquivos de programas\Secunia\PSI\psi.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O8 - Extra context menu item: Abrir em uma nova guia do plano de fundo - res://C:\Arquivos de programas\Windows Live Toolbar\Components\pt-br\msntabres.dll.mui/229?86bbc0f9a5b54e018bd3dad3a067a29f

O8 - Extra context menu item: Abrir em uma nova guia do primeiro plano - res://C:\Arquivos de programas\Windows Live Toolbar\Components\pt-br\msntabres.dll.mui/230?86bbc0f9a5b54e018bd3dad3a067a29f

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {051D0E35-F4E3-4C8D-B411-AB0875F4C683} (Anark Client 4.0 ActiveX Control) - http://install.anark.com/client/version4/windows-ie/en/AMClient.cab

O16 - DPF: {1DB93715-3B60-43EE-93E6-279BB3E1DF76} (OCXDownloadChecker Control) - http://www.brasilmagazine.ddns.info:8000/cab/OCXChecker_6110.cab

O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://img4.orkut.com/activex/10036/photouploader.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab

O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

O16 - DPF: {9EC30204-384D-11D3-9CA3-00A024F0AF03} (ValidaUsuario Class) - https://cpne.bradesco.com.br/certifexp.cab

O16 - DPF: {B3D3825B-2120-4B0E-8C45-80ECC1D3E70D} (GeraCert Class) - https://bradesconetempresa.com.br/pj/CA.cab

O16 - DPF: {DBAFE6AD-DC14-45DF-A3F7-F8832289A1CD} (DownloadFile Control) - http://www.brasilmagazine.ddns.info:8000/cab/DownloadFile_7000.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399003} (GbPluginObj Class) - https://imagem.caixa.gov.br/cab/GbPluginCef.cab

O16 - DPF: {F5DF7803-CB7B-4198-9D7A-42DCA34F6B76} (MPSecVideo Control) - http://cvc.micropower.com.br/downloads/mpsecvideoplayer.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{884AF95F-7400-449B-BA1D-0CCEB3FD81E8}: NameServer = 201.10.1.2,201.10.128.3

O20 - Winlogon Notify: GbPluginBb - C:\ARQUIV~1\GBPLUGIN\gbieh.dll

O20 - Winlogon Notify: GbPluginCef - C:\Arquivos de programas\GbPlugin\gbiehcef.dll

O20 - Winlogon Notify: __GbPluginBb - C:\ARQUIVOS DE PROGRAMAS\GBPLUGIN\gbieh.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Gbp Service (GbpSv) - - C:\ARQUIV~1\GbPlugin\GbpSv.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\arquivos de programas\arquivos comuns\logishrd\lvmvfm\LVPrcSrv.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Arquivos de programas\Arquivos comuns\LogiShrd\SrvLnch\SrvLnch.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--

End of file - 10098 bytes

wings · Dezembro 6, 2009

Boa noite francisnei

*Baixe o MalwareBytes Anti-malware e salve-o no desktop:

*Instale o programa

*Ao finalizar, se alguma atualização existir,o download será automático. Aguarde...

*Terminada a atualização, o programa será aberto automaticamente.

*Na aba [Verificação], selecione a opção [Verificação completa]

*Clique em [Verificar] e selecione as unidades a serem examinadas

*Remova o que for encontrado

*Ao término do scan poderá ser interrogado se deseja remover objetos da memória. Clique [sIM] e finalmente clique em [OK]. Um relatório (mbam-log-ano-mês-data.txt) será apresentado.

*Alguns malwares são rebeldes e necessitam de uma reinicialização para a remoção. Caso isto seja solicitado, clique para reiniciar o PC. Caso não seja solicitado, reinicie o PC manualmente.

*Abra novamente o programa Malwarebytes e na aba [Logs] clique no arquivo mbam-log-ano-mês-data.txt

*Clique em [Abrir], copie, cole-o na sua próxima resposta e novo log do hijack

francisnei · Dezembro 7, 2009

Conforme solicitado segue abaixo:

mbam-log-2009-12-07 (11-26-46)

Malwarebytes' Anti-Malware 1.42

Versão do banco de dados: 3308

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13

7/12/2009 11:27:01

mbam-log-2009-12-07 (11-26-46).txt

Tipo de Verificação: Completa (C:\|)

Objetos verificados: 170435

Tempo decorrido: 1 hour(s), 7 minute(s), 41 second(s)

Processos da Memória infectados: 0

Módulos de Memória Infectados: 0

Chaves do Registro infectadas: 1

Valores do Registro infectados: 1

Ítens do Registro infectados: 0

Pastas infectadas: 2

Arquivos infectados: 84

Processos da Memória infectados:

(Nenhum ítem malicioso foi detectado)

Módulos de Memória Infectados:

(Nenhum ítem malicioso foi detectado)

Chaves do Registro infectadas:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__gbpluginbb (Trojan.Vundo) -> No action taken.

Valores do Registro infectados:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{110b50f0-4954-4300-b71d-d4de33922b3a} (Rogue.SpywareCleaner2009) -> No action taken.

Ítens do Registro infectados:

(Nenhum ítem malicioso foi detectado)

Pastas infectadas:

C:\Spyware Cleaner 2009 V3.04 (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP (Rogue.SpywareCleaner2009) -> No action taken.

Arquivos infectados:

C:\Documents and Settings\Administrador\Meus documentos\Download\webcam\rnsetup.exe (Rogue.SpywareCleaner2009) -> No action taken.

C:\System Volume Information\_restore{9773B32B-5466-4576-A5F6-C7684D997741}\RP521\A0084431.exe (Trojan.Downloader) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\ast103.rda (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\ast104.rda (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\ast105.rda (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\ast106.rda (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\ast107.rda (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\ast108.rda (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\ast109.rda (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\ast110.rda (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\ast111.rda (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\ast112.rda (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\ast113.rda (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\ast114.rda (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\ast115.rda (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\ast116.rda (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\ast117.rda (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\ast118.rda (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\ast119.rda (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\ast120.rda (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\ast121.rda (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\ast122.rda (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\ast123.rda (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\ast124.rda (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\ast125.rda (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\ast126.rda (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\ast127.rda (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\ast128.rda (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\ast129.rda (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\dth009.rnt (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\dth010.rnt (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\dth011.rnt (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\dth012.rnt (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\dth013.rnt (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\dth014.rnt (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\dth015.rnt (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\dth016.rnt (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\dth017.rnt (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\dth018.rnt (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\dth019.rnt (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\dth020.rnt (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\dth021.rnt (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\dth022.rnt (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\dth023.rnt (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\dth024.rnt (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\dth025.rnt (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\dth026.rnt (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\dth027.rnt (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\dth028.rnt (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\dth029.rnt (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\dth030.rnt (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\dth031.rnt (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\dth032.rnt (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\dth033.rnt (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\dth034.rnt (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\el7005.rst (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\el7006.rst (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\el7007.rst (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\el7008.rst (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\el7009.rst (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\el7010.rst (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\el7011.rst (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\el7012.rst (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\el7013.rst (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\el7014.rst (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\el7015.rst (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\el7016.rst (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\el7017.rst (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\el7018.rst (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\el7019.rst (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\el7020.rst (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\el7021.rst (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\el7022.rst (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\fi3909.ric (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\fi3910.ric (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\fi3911.ric (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\fi3912.ric (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\fi3913.ric (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\fi3914.ric (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\fi3915.ric (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\fi3916.ric (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\fi3917.ric (Rogue.SpywareCleaner2009) -> No action taken.

C:\Spyware Cleaner 2009 V3.04\UP\fi3918.ric (Rogue.SpywareCleaner2009) -> No action taken.

C:\ARQUIVOS DE PROGRAMAS\GbPlugin\gbieh.dll (Trojan.Vundo) -> No action taken.

-----------------------------------------------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:12:57, on 7/12/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16915)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\ARQUIV~1\GbPlugin\GbpSv.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\Explorer.EXE

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\Arquivos de programas\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\HPZipm12.exe

C:\Arquivos de programas\BrOffice.org 3\program\soffice.exe

C:\Arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\Arquivos de programas\BrOffice.org 3\program\soffice.bin

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\Arquivos de programas\HP\Digital Imaging\Product Assistant\bin\hprblog.exe

C:\Arquivos de programas\Windows Live\Contacts\wlcomm.exe