[Arquivado] "existem demasiados emails identicos..."

[jcarlos_96 0]

LOG MBR

 

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

 

device: opened successfully

user: MBR read successfully

kernel: MBR read successfully

user & kernel MBR OK

 

 

RESULTADOS VIRSCAN:

 

c:\windows\system32\drivers\99398212.sys

 

Clique'>http://virscan.org/report/b48fc0f5164bd68a70394449d7f0a8cc.html"]Clique aqui

 

c:\windows\system32\drivers\9939821.sys

 

Clique'>http://virscan.org/report/576f91c8c2bc0fe163152b01795215ec.html"]Clique aqui

 

c:\windows\system32\drivers\99398211.sys

 

Clique'>http://virscan.org/report/e2aa081dfacdb9d0c92aca2b234c0731.html"]Clique aqui

 

c:\windows\system32\diskuery.dll

Clique'>http://virscan.org/report/296a46298f23ec3b33b78e1aee21d462.html"]Clique aqui

 

c:\documents and settings\Pina\winfh.dll

 

Clique'>http://virscan.org/report/df7039dd05411eb4c12663cf3b3258fb.html"]Clique aqui

 

 

Nenhum dos programas Anti-RootKit encontraram ameaças.

 

 

NOVO LOG HIGHJACKTHIS

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:52:10, on 30-12-2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16945)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Programas\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe

C:\Programas\Ficheiros comuns\Real\Update_OB\realsched.exe

C:\Programas\Ficheiros comuns\LightScribe\LSSrvc.exe

C:\Programas\Windows Defender\MSASCui.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Programas\Sharp\Sharpdesk\SharpTray.exe

C:\Programas\Ficheiros comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programas\SHARP\Button Manager E\btnman.exe

C:\Programas\Windows Desktop Search\WindowsSearch.exe

C:\Programas\Windows Desktop Search\WindowsSearchIndexer.exe

c:\Programas\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\WINDOWS\system32\svchost.exe

C:\Programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Programas\Alwil Software\Avast4\ashWebSv.exe

C:\Programas\Windows Desktop Search\WindowsSearchFilter.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Programas\Mozilla Firefox\firefox.exe

C:\Documents and Settings\ANTONIO PINA\Ambiente de trabalho\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.clix.pt/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hiperligações

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Ficheiros comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Programas\Windows Desktop Search\dsWebAllow.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programas\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: Programa Auxiliar de Início de Sessão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programas\Ficheiros comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programas\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programas\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll

O2 - BHO: BHO - {CFCAAF92-3665-4aa3-BD88-5BFFE7C5C000} - C:\Documents and Settings\Pina\winfh.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programas\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Programas\Ficheiros comuns\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Windows Defender] "C:\Programas\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKCU\..\Run: [sharpTray] C:\Programas\Sharp\Sharpdesk\SharpTray.exe

O4 - HKCU\..\Run: [swg] "C:\Programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHEI~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: setup_9.0.0.722_25.12.2009_11-11.lnk = C:\Documents and Settings\ANTONIO PINA\Ambiente de trabalho\Virus Removal Tool\setup_9.0.0.722_25.12.2009_11-11\startup.exe

O4 - Global Startup: Button Manager E.lnk = C:\Programas\SHARP\Button Manager E\btnman.exe

O4 - Global Startup: Windows Desktop Search.lnk = C:\Programas\Windows Desktop Search\WindowsSearch.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Google Sidewiki... - res://C:\Programas\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programas\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programas\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Publicar em Blogue - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programas\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Publicar no Blogue no Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programas\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe

O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/Windows/Initial/VideoEggPublisher.exe

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{956C79DE-2B8A-4552-84E9-C2CE5E24EA7B}: NameServer = 192.168.1.1

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programas\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programas\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Serviço Google Update (gupdate) (gupdate) - Google Inc. - C:\Programas\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programas\Ficheiros comuns\LightScribe\LSSrvc.exe

O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programas\Ficheiros comuns\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Programas\Ficheiros comuns\SolidWorks Shared\Service\SolidWorksLicensing.exe

 

--

End of file - 7764 bytes

[Power Max 54]

c:\windows\system32\drivers\99398212.sys

c:\windows\system32\drivers\99398211.sys

:seta: Estes dois arquivos vieram com nomes diferentes nos resultados do escaneamento do VirSCAN. Envie eles por gentileza nestes outros sites abaixo para análise para termos certeza de que sejam seguros:

http://www.virustotal.com/

http://virusscan.jotti.org/

http://www.viruschief.com/

 

E depois nos diga se os arquivos foram considerados seguros ou não nos escaneamentos dos sites acima.

_____________________________________

 

:seta: Baixe o programa Avenger no link abaixo e extraia o conteúdo para o desktop (área de trabalho):

http://swandog46.geekstogo.com/avenger2/download.php

 

*Selecione e copie (Ctrl+C) todo o texto dentro do Quote (caixa branca) abaixo:

 

Files to delete:

c:\windows\system32\diskuery.dll

 

*Execute o programa Avenger

*Clique em [Load Script] > [Paste from Clipboard]

*Clique em [Execute] > [OK]

*O PC será reiniciado

*O relatório será criado em C:\avenger.txt

______________________________________

 

:seta: Poste este log do Avenger que estará em C:\avenger.txt e nos diga se os arquivos foram considerados seguros ou não nos escaneamentos.

[jcarlos_96 0]

Logfile of The Avenger Version 2.0, © by Swandog46

http://swandog46.geekstogo.com

 

Platform: Windows XP

 

*******************

 

Script file opened successfully.

Script file read successfully.

 

Backups directory opened successfully at C:\Avenger

 

*******************

 

Beginning to process script file:

 

Rootkit scan active.

No rootkits found!

 

File "c:\windows\system32\diskuery.dll" deleted successfully.

 

Completed script processing.

 

*******************

 

Finished! Terminate.

 

 

os dois ficheiros estão limpos, em todos os sites mencionados! Quer que coloque aqui os relatórios?

 

Entretanto o windows tem uma actualização já há uns dias e nunca consegue terminar a actualização...

 

a actualização é:

 

Microsoft SQL Server 2005 Express edition Service pack 3

[Power Max 54]

:) Mais um problema foi removido do seu PC.

 

:seta: Siga, por gentileza as dicas deste tutorial para fazer uma limpeza de seu PC com o Spyware Doctor:

 

Tutorial do Spyware Doctor Starter Edition

 

Na sua próxima resposta poste este log do Spyware Doctor juntamente com um novo log do Hijackthis e nos diga como está o seu Pc depois disto.

 

Ficamos no aguardo.

[jcarlos_96 0]

:) Mais um problema foi removido do seu PC.

 

eu reparei! Muito obrigado!

 

Vou usar o spywaredoctor, e volto já!

 

A ver se acabo com o virus ainda este ano e entro no novo ano "limpo"!

[jcarlos_96 0]

A instalação dá erro...

 

diz:

 

c:\programas\ficheiros comuns\PC Tools\Lsp\PCTLsp.dll

ocorreu um erro ao tentar ler o ficheiro de origem:

O acesso é negado.

 

_______________"________

 

erro ao criar entrada INI no ficheiro c:\programas\spyware doctor\homepage.url

 

:natal_dry:

[Power Max 54]

A instalação dá erro...

 

diz:

 

c:\programas\ficheiros comuns\PC Tools\Lsp\PCTLsp.dll

ocorreu um erro ao tentar ler o ficheiro de origem:

O acesso é negado.

:seta: Tente executar o Spyware Doctor no Modo seguro e veja se é possível.

 

Se mesmo assim não for possível, siga esta outra dica:

 

Tutorial do Norman Malware Cleaner

 

E depois poste o log dele para ser analisado.

[jcarlos_96 0]

log norman malware cleaner

 

Norman Malware Cleaner

Version 1.6.2

Copyright © 1990 - 2009, Norman ASA. Built 2009/12/31 08:29:54

 

Norman Scanner Engine Version: 6.04.03

Nvcbin.def Version: 6.04.00, Date: 2009/12/31 08:29:54, Variants: 4653509

 

Scan started: 31/12/2009 16:45:35

 

Running pre-scan cleanup routine:

Operating System: Microsoft Windows XP Professional 5.1.2600 Service Pack 3

Logged on user: POSTO1\ANTONIO PINA

 

Set registry value: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLS = -> ""

Removed registry value: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -> DisableRegistryTools = 0x00000000

Removed registry value: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer -> NoDrives = 0x00000000

Removed registry value: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer -> NoDrives = 0x00000000

 

Scanning bootsectors...

 

Number of sectors found: 0

Number of sectors scanned: 0

Number of sectors not scanned: 0

Number of infections found: 0

Number of infections removed: 0

Total scanning time: 0s

 

 

Scanning running processes and process memory...

 

Number of processes/threads found: 3955

Number of processes/threads scanned: 3955

Number of processes/threads not scanned: 0

Number of infected processes/threads terminated: 0

Total scanning time: 3m 33s

 

 

Scanning file system...

 

Scanning: prescan

 

Scanning: C:\*.*

 

C:\Documents and Settings\ANTONIO PINA\Ambiente de trabalho\Your+Uninstaller!+2008+PRO+6.2.1347__WWW.PIRATATUGA.NET.rar/CMT (Error whilst scanning file: I/O Error (0x00220000))

 

C:\Documents and Settings\ANTONIO PINA\Definições locais\temp\is-79BE3.tmp\iMonitor.exe (Infected with W32/Agent.SAZX)

Deleted file

 

C:\Documents and Settings\ANTONIO PINA\Definições locais\temp\is-D7JC2.tmp\iMonitor.exe (Infected with W32/Agent.SAZX)

Deleted file

 

C:\Documents and Settings\ANTONIO PINA\Definições locais\temp\is-IPO92.tmp\iMonitor.exe (Infected with W32/Agent.SAZX)

Deleted file

 

C:\Documents and Settings\ANTONIO PINA\Definições locais\temp\is-PQ105.tmp\iMonitor.exe (Infected with W32/Agent.SAZX)

Deleted file

 

C:\LinhaDefensiva\exec\download.exe (Infected with Suspicious_Gen.CQSA)

Deleted file

 

C:\prg\Programas\CS\Half-Life\a3dapi.dll (Infected with W32/Script_Gen2.A)

Deleted file

 

C:\prg\Programas\CS\Half-Life\csubackup\a3dapi.dll (Infected with W32/Script_Gen2.A)

Deleted file

 

C:\prg\Programas\Gestão de Ficheiros DRI\_uninst\uninstall.dat/com/installshield/product/ProductTree.qjml (Error whilst scanning file: I/O Error (0x00220005))

 

C:\prg\Programas\Gestão de Ficheiros DRI\_uninst\uninstall.dat/b4d3033557688aba503e1a6710f61301/beanDRITaxasFiles/installed (Error whilst scanning file: I/O Error (0x00220005))

 

C:\prg\Programas\Gestão de Ficheiros DRI\_uninst\uninstall.dat/b4d3033557688aba503e1a6710f61301/beanDRIJARFile/installed (Error whilst scanning file: I/O Error (0x00220005))

 

C:\prg\Programas\Gestão de Ficheiros DRI\_uninst\uninstall.dat/b4d3033557688aba503e1a6710f61301/beanExternalJARSFiles/installed (Error whilst scanning file: I/O Error (0x00220005))

 

C:\prg\Programas\Gestão de Ficheiros DRI\_uninst\uninstall.dat/b4d3033557688aba503e1a6710f61301/beanExternalDLLsFiles/installed (Error whilst scanning file: I/O Error (0x00220005))

 

C:\prg\Programas\Gestão de Ficheiros DRI\_uninst\uninstall.dat/b4d3033557688aba503e1a6710f61301/beanImagesFiles/installed (Error whilst scanning file: I/O Error (0x00220005))

 

C:\prg\Programas\Gestão de Ficheiros DRI\_uninst\uninstall.jar/com/installshield/wizard/Wizard.qjml (Error whilst scanning file: I/O Error (0x00220005))

 

C:\prg\Programas\Gestão de Ficheiros DRI\_uninst\uninstall.jar/com/installshield/wizard/WizardTree.qjml (Error whilst scanning file: I/O Error (0x00220005))

 

C:\prg\Programas\Gestão de Ficheiros DRI\_uninst\uninstall.jar/com/installshield/wizard/service/ServicesDefinition.qjml (Error whilst scanning file: I/O Error (0x00220005))

 

C:\prg\Programas\Gestão de Ficheiros DRI\_uninst\uninstall.jar/b4d3033557688aba503e1a6710f61301/wizard.xml (Error whilst scanning file: I/O Error (0x00220005))

 

C:\prg\Programas\Gestão de Ficheiros DRI\_uninst\uninstall.jar/b4d3033557688aba503e1a6710f61301/wizardTree.xml (Error whilst scanning file: I/O Error (0x00220005))

 

C:\prg\Programas\Gestão de Ficheiros DRI\_uninst\uninstall.jar/b4d3033557688aba503e1a6710f61301/3be25aaade452f990318d25965d5285e/awt/welcome.gif (Error whilst scanning file: I/O Error (0x00220005))

 

C:\prg\Programas\Gestão de Ficheiros DRI\_uninst\uninstall.jar/b4d3033557688aba503e1a6710f61301/3be25aaade452f990318d25965d5285e/awt/icon.gif (Error whilst scanning file: I/O Error (0x00220005))

 

C:\prg\Programas\Gestão de Ficheiros DRI\_uninst\uninstall.jar/b4d3033557688aba503e1a6710f61301/win32ppk/ConsoleLauncher.exe (Error whilst scanning file: I/O Error (0x00220005))

 

C:\prg\Programas\Gestão de Ficheiros DRI\_uninst\uninstall.jar/b4d3033557688aba503e1a6710f61301/win32ppk/LauncherMain.exe (Error whilst scanning file: I/O Error (0x00220005))

 

C:\prg\Programas\Gestão de Ficheiros DRI\_uninst\uninstall.jar/b4d3033557688aba503e1a6710f61301/973bd76de75868b1648179bf3c20511f/awt/welcome.gif (Error whilst scanning file: I/O Error (0x00220005))

 

C:\prg\Programas\Gestão de Ficheiros DRI\_uninst\uninstall.jar/b4d3033557688aba503e1a6710f61301/973bd76de75868b1648179bf3c20511f/awt/icon.gif (Error whilst scanning file: I/O Error (0x00220005))

 

C:\prg\Programas\Gestão de Ficheiros DRI\_uninst\uninstall.jar/b4d3033557688aba503e1a6710f61301/win32ppk/win32ppk.dll (Error whilst scanning file: I/O Error (0x00220005))

 

C:\prg\Programas\Gestão de Ficheiros DRI\_uninst\uninstall.jar/b4d3033557688aba503e1a6710f61301/win32ppk/isjecln.exe (Error whilst scanning file: I/O Error (0x00220005))

 

C:\prg\Programas\Gestão de Ficheiros DRI\_uninst\uninstall.jar/b4d3033557688aba503e1a6710f61301/win32ppk/Verify.jar (Error whilst scanning file: I/O Error (0x00220005))

 

C:\prg\Programas\Gestão de Ficheiros DRI\_uninst\uninstall.jar/b4d3033557688aba503e1a6710f61301/services.xml (Error whilst scanning file: I/O Error (0x00220005))

 

C:\prg\Programas\MyWebSearch\bar\1.bin\M3IMPIPE.EXE (Infected with W32/MyWebSearch.KQ)

Deleted file

 

C:\Programas\Gestão de Ficheiros DRI\_uninst\uninstall.jar/com/installshield/wizard/Wizard.qjml (Error whilst scanning file: I/O Error (0x00220005))

 

C:\Programas\Gestão de Ficheiros DRI\_uninst\uninstall.jar/com/installshield/wizard/WizardTree.qjml (Error whilst scanning file: I/O Error (0x00220005))

 

C:\Programas\Gestão de Ficheiros DRI\_uninst\uninstall.jar/com/installshield/wizard/service/ServicesDefinition.qjml (Error whilst scanning file: I/O Error (0x00220005))

 

C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\_mmsuwl_.sys.zip/mmsuwl.sys (Infected with W32/Rootkit.BEKQ)

Deleted file

 

C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\_mmsuwl_.sys.zip (Empty archive after cleaning)

Deleted file

 

C:\System Volume Information\_restore{A74AA50A-3122-4AC1-AA77-67EE679DC7A4}\RP662\A0109164.exe (Infected with Perfloger.AUR)

Deleted file

 

C:\System Volume Information\_restore{A74AA50A-3122-4AC1-AA77-67EE679DC7A4}\RP662\A0109165.exe (Infected with Perfloger.AUR)

Deleted file

 

C:\System Volume Information\_restore{A74AA50A-3122-4AC1-AA77-67EE679DC7A4}\RP662\A0109166.exe (Infected with Perfloger.AUR)

Deleted file

 

C:\System Volume Information\_restore{A74AA50A-3122-4AC1-AA77-67EE679DC7A4}\RP662\A0109167.exe (Infected with Perfloger.AUR)

Deleted file

 

C:\System Volume Information\_restore{A74AA50A-3122-4AC1-AA77-67EE679DC7A4}\RP731\A0119664.dll (Infected with W32/Script_Gen2.A)

Deleted file

 

C:\System Volume Information\_restore{A74AA50A-3122-4AC1-AA77-67EE679DC7A4}\RP742\A0125445.sys (Infected with W32/Agent.HHSF)

Deleted file

 

C:\System Volume Information\_restore{A74AA50A-3122-4AC1-AA77-67EE679DC7A4}\RP742\A0125451.exe (Infected with W32/Zapchast.CTP)

Deleted file

 

C:\System Volume Information\_restore{A74AA50A-3122-4AC1-AA77-67EE679DC7A4}\RP754\A0127767.sys (Infected with W32/Agent.HHSF)

Deleted file

 

C:\System Volume Information\_restore{A74AA50A-3122-4AC1-AA77-67EE679DC7A4}\RP754\A0127779.exe (Infected with W32/Zapchast.CTP)

Deleted file

 

C:\System Volume Information\_restore{A74AA50A-3122-4AC1-AA77-67EE679DC7A4}\RP754\A0129393.exe (Infected with Suspicious_Gen.CQSA)

Deleted file

 

C:\System Volume Information\_restore{A74AA50A-3122-4AC1-AA77-67EE679DC7A4}\RP754\A0129394.dll (Infected with W32/Script_Gen2.A)

Deleted file

 

C:\System Volume Information\_restore{A74AA50A-3122-4AC1-AA77-67EE679DC7A4}\RP754\A0129395.dll (Infected with W32/Script_Gen2.A)

Deleted file

 

C:\System Volume Information\_restore{A74AA50A-3122-4AC1-AA77-67EE679DC7A4}\RP754\A0129396.EXE (Infected with W32/MyWebSearch.KQ)

Deleted file

 

Scanning: A:\*.*

 

Scanning: E:\*.*

 

Scanning: F:\*.*

 

Scanning: G:\*.*

 

Scanning: postscan

 

 

Running post-scan cleanup routine:

 

Number of files found: 353306

Number of archives unpacked: 1679

Number of files scanned: 353279

Number of files not scanned: 27

Number of files skipped due to exclude list: 0

Number of infected files found: 23

Number of infected files repaired/deleted: 23

Number of infections removed: 23

Total scanning time: 2h 11m 26s

log highjackthis

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:07:54, on 31-12-2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16945)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Programas\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programas\Ficheiros comuns\LightScribe\LSSrvc.exe

C:\Programas\Ficheiros comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\Programas\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\WINDOWS\system32\svchost.exe

C:\Programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Programas\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe

C:\Programas\Ficheiros comuns\Real\Update_OB\realsched.exe

C:\Programas\Windows Defender\MSASCui.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Programas\Sharp\Sharpdesk\SharpTray.exe

C:\Programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programas\SHARP\Button Manager E\btnman.exe

C:\Programas\Windows Desktop Search\WindowsSearch.exe

C:\Programas\Windows Desktop Search\WindowsSearchIndexer.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\ANTONIO PINA\Ambiente de trabalho\gol.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Programas\Mozilla Firefox\firefox.exe

C:\Programas\Trend Micro\HijackThis\HijackThis.exe

C:\Documents and Settings\ANTONIO PINA\Ambiente de trabalho\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.clix.pt/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hiperligações

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Ficheiros comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Programas\Windows Desktop Search\dsWebAllow.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programas\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: Programa Auxiliar de Início de Sessão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programas\Ficheiros comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programas\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programas\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll

O2 - BHO: BHO - {CFCAAF92-3665-4aa3-BD88-5BFFE7C5C000} - C:\Documents and Settings\Pina\winfh.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programas\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Programas\Ficheiros comuns\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Windows Defender] "C:\Programas\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [iSTray] "C:\Programas\Spyware Doctor\pctsTray.exe"

O4 - HKCU\..\Run: [sharpTray] C:\Programas\Sharp\Sharpdesk\SharpTray.exe

O4 - HKCU\..\Run: [swg] "C:\Programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHEI~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Button Manager E.lnk = C:\Programas\SHARP\Button Manager E\btnman.exe

O4 - Global Startup: Windows Desktop Search.lnk = C:\Programas\Windows Desktop Search\WindowsSearch.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Google Sidewiki... - res://C:\Programas\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programas\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programas\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Publicar em Blogue - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programas\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Publicar no Blogue no Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programas\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe

O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/Windows/Initial/VideoEggPublisher.exe

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{956C79DE-2B8A-4552-84E9-C2CE5E24EA7B}: NameServer = 192.168.1.1

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programas\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programas\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Serviço Google Update (gupdate) (gupdate) - Google Inc. - C:\Programas\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programas\Ficheiros comuns\LightScribe\LSSrvc.exe

O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programas\Ficheiros comuns\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Programas\Ficheiros comuns\SolidWorks Shared\Service\SolidWorksLicensing.exe

 

--

End of file - 7750 bytes

 

 

Se puder analisar, agradeço!

Amanha digo se já faz as actualizações automáticas

 

Aproveito para desejar umas optimas entradas no novo ano!

 

Tudo de bom para você, obrigado por tudo!

[Power Max 54]

Aproveito para desejar umas optimas entradas no novo ano!

:natal_smile: Valeu, Jcarlos! Um excelente Ano Novo de muita paz e felicidades para você e sua família!

__________________________________

 

:) Vários problemas foram removidos pelo Norman.

 

:seta: Siga, por gentileza, as dicas deste tutorial para fazer um escaneamento de seu PC pelo Nod32 Online:

 

Tutorial do antivirus Nod32 Online

 

Após o término do escaneamento será gerado um relatório (log) que estará no seguinte local do seu computador:

C:\Arquivos de programas\Eset\Eset Online Scanner\log.txt

 

Na sua próxima resposta poste este log do Nod32 Online juntamente com um novo log do Hijackthis e nos diga, por gentileza, como está o seu PC após seguir este procedimento. Ficamos no aguardo de sua resposta.

[jcarlos_96 0]

ja tentei de duas formas...

 

Entrar pelo Internet Explorer não funciona! Após clicar em instalar fica parado e nunca chega a arrancar.

 

Tentei tambem instalar o installer para outros browsers mas o mesmo também dá erro ao instalar...

 

Não sei mais que fazer... :natal_sad:

[Power Max 54]

ja tentei de duas formas...

 

Entrar pelo Internet Explorer não funciona! Após clicar em instalar fica parado e nunca chega a arrancar.

 

Tentei tambem instalar o installer para outros browsers mas o mesmo também dá erro ao instalar...

 

Não sei mais que fazer... :natal_sad:

Tudo bem, então deixemos o Nod32 para depois e façamos o seguinte:

 

:seta: Siga as dicas deste tutorial:

Tutorial do Dr. Web CureIt

 

Na sua próxima resposta poste este log do Dr. Web CureIt juntamente com um novo log do Hijackthis e nos diga como está o seu Pc depois disto.

 

Ficamos no aguardo.

[jcarlos_96 0]

coloquei ontem rolando...

 

na primeira pesquisa não encontrou nada.

 

 

Na avançada detectou dois que diziam algo do genero:

c:/system32/.../avg

Eliminou os dois.

 

O problema é que sobreaqueceu e encerrou, ainda nem tinha chegado a meio... :s

 

vou colocar agora novamente rodando...

[Power Max 54]

O problema é que sobreaqueceu e encerrou, ainda nem tinha chegado a meio... :s

 

vou colocar agora novamente rodando...

Se o PC estiver esquentando muito, seria bom colocar um ventilador apontado para a parte da frente de seu computador para mantê-lo bem refrigerado.

[jcarlos_96 0]

eu acho que desta vez encravou...

 

ele já está a uma hora talvez no mesmo ficheiro...

 

não avança!

 

A propria contagem de ficheiros scaneados nao avança...

 

e normal encravar com esse programa?

 

estou desanimando... :(

 

até mesmo no gestor de tarefas não aparece o programa executando...

 

porque será?

[Power Max 54]

ele já está a uma hora talvez no mesmo ficheiro...

 

não avança!

 

A propria contagem de ficheiros scaneados nao avança...

 

Talvez sejam os virus que estejam bloqueando ele.

 

Tente fazer a verificação completa com ele no '>http://dicasetutoriaisparapc.blogspot.com/2009/11/ferramentas-para-reparar-o-modo-seguro.html"]Modo Seguro e veja se é possível.

[jcarlos_96 0]

 

Talvez sejam os virus que estejam bloqueando ele.

 

Tente fazer a verificação completa com ele no '>http://dicasetutoriaisparapc.blogspot.com/2009/11/ferramentas-para-reparar-o-modo-seguro.html"]Modo Seguro e veja se é possível.

 

ele está em modo seguro companheiro...

 

mudei nome ao salvar, reiniciei em modo seguro e executei... mas agora não anda!

 

Tentei clicar no botão pause e play novamente e funcionou na perfeição, apagou um botao, acendeu o outro, etc...

o programa nem parece ter crachado!

 

mas a verdade é que não sai desse ficheiro... :(

 

vai em 3horas e ainda não passou de 1/4 do total do processo total...

velocidade 370 kb/s

 

o ficheiro que aparece diz: c:\tup.exe\-{app}-\gamedata\stadium\constructionblock...

 

isso lhe diz alguma coisa? :S

[Power Max 54]

Realmente estes malwares que estão no seu PC são bem resistentes...

 

:seta: Tente fazer uma limpeza com este antivirus online abaixo e veja se é possível:

 

Tutorial do antivírus BitDefender Online

 

Após o término do escaneamento será gerado um relatório (log) que estará no seguinte local do seu computador:

C:\Windows\BDOSCAN8\bdoscan.log

 

Na sua próxima resposta poste este log do BitDefender Online juntamente com um novo log do Hijackthis e nos diga, por gentileza, como está o seu PC após seguir este procedimento.

 

Ficamos no aguardo de sua resposta.

[jcarlos_96 0]

amigo, ele entretanto avançou...

 

Desculpa ser chato, mas por vezes dá um desanimo...

 

vou sair, mas vou deixar terminando durante a noite, amanha volto com novidades!

 

Obrigado pela paciencia!

[Power Max 54]

amigo, ele entretanto avançou...

Tem vezes que o escaneamento parece que parou mas depois ele continua mesmo, é porque é um processo lento.

 

Fico no aguardo.

[jcarlos_96 0]

bem... 23horas depois, está quase igual... :s

 

só avançou uns 100 / 200 ficheiros desde ontem...

 

acha que devo cancelar e avançar com o bit defender?

 

coloquei o bitdefender correndo, ja fez mais de 50% e não detectou nada...

 

o computador, também não tem dado erros, nem avisos de virus...

 

neste momento o unico problema é que não faz a actualização já faz semanas.

 

acha que também pode ser devido a virus?

 

log bitdefender

[General]

App = "楂䑴晥湥敤⁲湏楬敮匠慣湮牥 v8"

Date = 07:01:2010

Time = 22:18:34

Scan Path = A:\;C:\;E:\;F:\;G:\;

 

[Engines Info]

Virus Definitions = 4837947

Engine build = "AVCORE v2.1 Windows/i386 11.0.0.33 (Nov 24 2009)"

Scan plugins = 17

Archive plugins = 44

Unpack plugins = 8

E-mail plugins = 6

System plugins = 4

 

[scan Statistics]

Folders = 10424

Files = 458707

Archives = 6428

Packed files = 17447

Identified viruses = 1

Infected files = 2

Warnings = 0

Suspect files = 0

Disinfected files = 0

Deleted files = 2

Copied files = 0

Moved files = 0

Renamed files = 0

I/O Errors = 46

 

[scan Settings]

SecondAction = Delete

FirstAction = Disinfect

Heuristics = 1

Enable Warnings = 1

Exclude Ext =

Extensions = *;

Scan Emails = 1

Scan Archives = 1

Scan Packed = 1

Scan Files = 1

Scan Boot = 1

Verify Memory = 0

 

[scan Results]

Line00000003 = "C:\prg\Programas\Photoshop CS2\___crack\keygen-paradox-pscs2.exe Infected with: Worm.Generic.77249"

Line00000002 = "C:\prg\Programas\Photoshop CS2\___crack\keygen-paradox-pscs2.exe Deleted"

Line00000001 = "C:\System Volume Information\_restore{A74AA50A-3122-4AC1-AA77-67EE679DC7A4}\RP765\A0130588.exe Infected with: Worm.Generic.77249"

Line00000000 = "C:\System Volume Information\_restore{A74AA50A-3122-4AC1-AA77-67EE679DC7A4}\RP765\A0130588.exe Deleted"

 

 

 

 

 

 

 

 

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:23:34, on 07-01-2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16945)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Programas\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programas\Ficheiros comuns\LightScribe\LSSrvc.exe

C:\Programas\Ficheiros comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\Explorer.EXE

c:\Programas\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe

C:\Programas\Ficheiros comuns\Real\Update_OB\realsched.exe

C:\Programas\Windows Defender\MSASCui.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Programas\Sharp\Sharpdesk\SharpTray.exe

C:\Programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programas\SHARP\Button Manager E\btnman.exe

C:\Programas\Windows Desktop Search\WindowsSearch.exe

C:\Programas\Windows Desktop Search\WindowsSearchIndexer.exe

C:\Programas\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Programas\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Programas\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\SoftwareDistribution\Download\Install\SQLServer2005ExpressSP3-KB955706-x86-ENU.exe

c:\88f10cd1c92e22047e\hotfix.exe

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

c:\88f10cd1c92e22047e\HotFixExpress\Files\SQLEXPR.EXE

c:\9202981b902e201672b2da\setup.exe

C:\WINDOWS\system32\msiexec.exe

C:\Documents and Settings\ANTONIO PINA\Ambiente de trabalho\HijackThis.exe

c:\Programas\Microsoft SQL Server\90\Setup Bootstrap\setup.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sapo.pt/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hiperligações

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Ficheiros comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Programas\Windows Desktop Search\dsWebAllow.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programas\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: Programa Auxiliar de Início de Sessão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programas\Ficheiros comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programas\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programas\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll

O2 - BHO: BHO - {CFCAAF92-3665-4aa3-BD88-5BFFE7C5C000} - C:\Documents and Settings\Pina\winfh.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programas\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Programas\Ficheiros comuns\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Windows Defender] "C:\Programas\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [iSTray] "C:\Programas\Spyware Doctor\pctsTray.exe"

O4 - HKCU\..\Run: [sharpTray] C:\Programas\Sharp\Sharpdesk\SharpTray.exe

O4 - HKCU\..\Run: [swg] "C:\Programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHEI~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Button Manager E.lnk = C:\Programas\SHARP\Button Manager E\btnman.exe

O4 - Global Startup: Windows Desktop Search.lnk = C:\Programas\Windows Desktop Search\WindowsSearch.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Google Sidewiki... - res://C:\Programas\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programas\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programas\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Publicar em Blogue - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programas\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Publicar no Blogue no Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programas\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab

O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/Windows/Initial/VideoEggPublisher.exe

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{956C79DE-2B8A-4552-84E9-C2CE5E24EA7B}: NameServer = 192.168.1.1

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programas\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programas\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Serviço Google Update (gupdate) (gupdate) - Google Inc. - C:\Programas\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programas\Ficheiros comuns\LightScribe\LSSrvc.exe

O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programas\Ficheiros comuns\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Programas\Ficheiros comuns\SolidWorks Shared\Service\SolidWorksLicensing.exe

 

--

End of file - 8615 bytes

 

 

como disse antes não noto grandes problemas no PC a não ser o facto de não fazer a actualização automática que aparece todos os dias:

 

Microsoft SQL Server 2005 Express Edition service pack3