[Resolvido!] IE abre e fecha rapidamente

gilbertoros · Dezembro 27, 2009

Olá

estava tudo normal, quando entro em algum site que não me recordo, meu firewal comodo, me informa que processos estão querendo se implantar em meu sistema e se eu não havia feito nada eu deveria bloquear, foi o que eu fiz.

depois de algum tempo notei que não conseguia mais abri abas no IE 8, e quando fechei ele, quando tento abri-lo, ele simplesmente abre muito rapidamente e fecha.

O Mozila esta funcionando normalmente, e ja desinstalei o IE 8 e instalei de novo, funciona por algum tempo mas quando reinicio a maquina o problema volta.

Será virus?

Segue o log hijackthis:

Logfile of Trend Micro HijackThis v2.0.3 (BETA)

Scan saved at 19:58:53, on 27/12/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\ARQUIV~1\GbPlugin\GbpSv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\COMODO\COMODO Internet Security\cmdagent.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Windows Defender\MsMpEng.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe

C:\WINDOWS\system32\fsproflt.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\Arquivos de programas\Microsoft Private Folder 1.0\PrfldSvc.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\Arquivos de programas\ATI Technologies\ATI.ACE\cli.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe

C:\Arquivos de programas\CyberLink\PowerDVD9\PDVD9Serv.exe

C:\Arquivos de programas\Cyberlink\Shared Files\brs.exe

C:\Arquivos de programas\IObit\IObit SmartDefrag\IObit SmartDefrag.exe

C:\Arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe

C:\Arquivos de programas\Java\jre6\bin\jusched.exe

C:\Arquivos de programas\My Lockbox\mylbx.exe

C:\Arquivos de programas\COMODO\COMODO Internet Security\cfp.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Windows Defender\MSASCui.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\lib\NMBgMonitor.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\ATI Technologies\ATI.ACE\cli.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\Malwarebytes' Anti-Malware\mbam.exe

C:\WINDOWS\system32\msiexec.exe

C:\Arquivos de programas\TrendMicro\HiJackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [ATICCC] "C:\Arquivos de programas\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay

O4 - HKLM\..\Run: [avgnt] "C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [RemoteControl9] "C:\Arquivos de programas\CyberLink\PowerDVD9\PDVD9Serv.exe"

O4 - HKLM\..\Run: [bDRegion] C:\Arquivos de programas\Cyberlink\Shared Files\brs.exe

O4 - HKLM\..\Run: [smartDefrag] "C:\Arquivos de programas\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" /StartUp

O4 - HKLM\..\Run: [RemoteControl] "C:\Arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [mylbx] C:\Arquivos de programas\My Lockbox\mylbx.exe /a

O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Arquivos de programas\COMODO\COMODO Internet Security\cfp.exe" -h

O4 - HKLM\..\Run: [Windows Defender] "C:\Arquivos de programas\Windows Defender\MSASCui.exe" -hide

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Arquivos de programas\Arquivos comuns\Ahead\lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [RamBooster] C:\Arquivos de programas\RamBooster 2.0\Rambooster.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1252193064828

O16 - DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} (GbpDistObj Class) - https://www14.bancobrasil.com.br/plugin/GbpDist.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{AA30E960-20B3-4F84-8593-1B2150AB47EA}: NameServer = 201.21.192.116

O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll

O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Daemon de cache de categorias de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Arquivos de programas\COMODO\COMODO Internet Security\cmdagent.exe

O23 - Service: FSPro Filter Service (fsproflt) - FSPro Labs - C:\WINDOWS\system32\fsproflt.exe

O23 - Service: Gbp Service (GbpSv) - - C:\ARQUIV~1\GbPlugin\GbpSv.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe

O23 - Service: Private Folder Service (prfldsvc) - Unknown owner - C:\Arquivos de programas\Microsoft Private Folder 1.0\PrfldSvc.exe

--

End of file - 7543 bytes

DigRam · Dezembro 28, 2009

Boa Noite! gilbertoros

<@> Baixe: < > ( ...by sUBs )

<!> Link-2 --> < ForoSpyware >

<!> Link-3 --> < GeeksToGo >

<!> Link-4 --> < como usar o combofix >

<@> Salve-o no desktop!

<@> Desabilite as proteções residente de: antivírus,antispywares e firewall. ( Menos o do Windows! )

<@> Feche todas as janelas e execute a ferramenta!

<@> Ps: A execução,por comando,também é possível:
<@> Vá em Iniciar --> Executar --> Digite ou cole: "%userprofile%\desktop\Combofix.exe" /killall

<@> Clique em Ok.

<@> Na solicitação: "Negação de garantia de software" --> Clique em Sim!

<@> Não possuindo o "Console de Recuperação",aceite optar pela instalação do mesmo!

<@> Terminando,clique Sim ou Yes. --> Aguarde!

<!> Caso aconteça a notificação de: Aplicativo Win32 inválido,delete a ferramenta ComboFix.exe e faça,novamente,seu download.
<!> Salve-a no desktop,renomeada como: Kombo.exe

<!> Ps: Nomeie durante o salvamento,e não após salvá-la!

<!> Ps: Surgindo alguma mensagem de erro,rode o ComboFix.exe em "Modo de Segurança". <-- Link!

<!> Ps: Na presença de atividades rootkit,teremos a seguinte janela de notificação:

<!> Ps: Anote essas detecções,e dê o OK.

<!> Ps: Para completar as remoções,talvez haja necessidade da ferramenta reiniciar o computador. <-- Aguarde!

<!> Ps: Evite executar,voluntariamente,esta ferramenta!

<!> Ps: Para evitar problemas,siga todas as recomendações propostas.

<!> O ComboFix é uma ferramenta que pode danificar o sistema. Utilize-o,somente,sob supervisão profissional.

<@> Abrir-se-á a janela Auto Scan. --> Aguarde!

<@> Àfim de completar as remoções,o ComboFix poderá reiniciar o computador.

<@> Se houver necessidade,digite a opção para continuar! --> ( 1 ) --> Aperte Enter! --> Aguarde a conclusão!

<@> Durante o scan,evite manusear o mouse ou teclado! <-- Importante!

<@> Para parar ou sair do ComboFix,tecle "N" ou "2" --> Aperte Enter!

<><><><><><><><><><><><>

<@> Terminando,poste os relatórios: C:\ComboFix.txt + HijackThis,atualizado.

Abraços!

gilbertoros · Dezembro 28, 2009

Ok

Fiz os procedimentos, só me esqueci que tinha que instalar console de recuperação.

Devo fazer tudo de novo?

O IE 8 continua não funcionando, tento abril-lo e ele fecha rapidamente.

Segue os logs:

ComboFix 09-12-27.01 - zé 28/12/2009 3:26.4.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.511.186 [GMT -2:00]

Executando de: c:\documents and settings\zé\Desktop\ComboFix.exe

FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

ATENÇAO - ESTA MAQUINA NAO TEM O CONSOLE DE RECUPERAÇÃO INSTALADA !!

.

ADS - drivers: deleted 12 bytes in 1 streams.

(((((((((((((((( Arquivos/Ficheiros criados de 2009-11-28 to 2009-12-28 ))))))))))))))))))))))))))))

.

2009-12-28 01:42 . 2009-12-28 03:22 -------- d-----w- C:\C.DVDRip.Dual.Audio-www.therebels.biz-Pabinho

2009-12-27 22:12 . 2009-12-27 22:12 133839 ----a-w- c:\windows\cscmon.bin

2009-12-27 21:58 . 2009-12-27 21:58 388096 ----a-r- c:\documents and settings\zé\Dados de aplicativos\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe

2009-12-27 07:05 . 2009-12-27 07:07 -------- dc-h--w- c:\windows\ie8

2009-12-27 00:57 . 2009-12-27 00:57 -------- d-----w- c:\documents and settings\zé\Dados de aplicativos\Apple Computer

2009-12-27 00:36 . 2009-12-27 00:37 -------- d-----w- c:\arquivos de programas\QuickTime

2009-12-27 00:36 . 2009-12-27 00:36 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Apple Computer

2009-12-27 00:35 . 2009-12-27 00:35 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Apple

2009-12-27 00:34 . 2009-12-27 00:34 -------- d-----w- c:\arquivos de programas\Apple Software Update

2009-12-27 00:34 . 2009-12-27 00:34 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Apple

2009-12-25 00:32 . 2009-12-25 00:32 -------- d-----w- c:\arquivos de programas\Windows Defender

2009-12-25 00:00 . 2009-12-25 00:06 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Comodo

2009-12-25 00:00 . 2009-12-25 19:54 171552 ----a-w- c:\windows\system32\guard32.dll

2009-12-25 00:00 . 2009-12-25 19:54 87104 ----a-w- c:\windows\system32\drivers\inspect.sys

2009-12-25 00:00 . 2009-12-25 19:53 25160 ----a-w- c:\windows\system32\drivers\cmdhlp.sys

2009-12-25 00:00 . 2009-12-25 19:53 133064 ----a-w- c:\windows\system32\drivers\cmdguard.sys

2009-12-24 04:34 . 2009-12-24 04:34 -------- d-----w- C:\My Lockbox

2009-12-24 04:33 . 2009-12-24 04:33 -------- d-----w- c:\arquivos de programas\My Lockbox

2009-12-24 04:16 . 2009-05-03 14:22 73392 ----a-w- c:\windows\system32\fsproflt.exe

2009-12-24 04:16 . 2008-06-05 21:37 43792 ----a-w- c:\windows\system32\drivers\FSPFltd.sys

2009-12-24 03:25 . 2009-12-24 23:11 -------- d-----r- c:\documents and settings\zé\My Private Folder

2009-12-24 03:23 . 2009-12-24 03:23 -------- d-----w- c:\arquivos de programas\Microsoft Private Folder 1.0

2009-12-23 21:07 . 2009-12-23 21:07 40960 ----a-r- c:\documents and settings\zé\Dados de aplicativos\Microsoft\Installer\{ADE3CACC-EC31-480C-83A0-587EE60CE8DF}\Rambooster.exe1_ADE3CACCEC31480C83A0587EE60CE8DF_1.exe

2009-12-23 21:07 . 2009-12-23 21:07 40960 ----a-r- c:\documents and settings\zé\Dados de aplicativos\Microsoft\Installer\{ADE3CACC-EC31-480C-83A0-587EE60CE8DF}\NewShortcut2_ADE3CACCEC31480C83A0587EE60CE8DF.exe

2009-12-23 21:07 . 2009-12-23 21:07 10134 ----a-r- c:\documents and settings\zé\Dados de aplicativos\Microsoft\Installer\{ADE3CACC-EC31-480C-83A0-587EE60CE8DF}\ARPPRODUCTICON.exe

2009-12-23 21:07 . 2009-12-23 21:07 -------- d-----w- c:\arquivos de programas\RamBooster 2.0

2009-12-22 20:03 . 2009-12-22 20:03 -------- d-----w- c:\documents and settings\LocalService\Dados de aplicativos\Spam Monitor

2009-12-22 17:42 . 2009-12-25 01:13 -------- d-----w- C:\maicon

2009-12-22 04:34 . 2009-12-22 04:34 -------- d-----w- c:\documents and settings\zé\Dados de aplicativos\PCToolsFirewallPlus

2009-12-22 04:34 . 2009-12-22 04:34 -------- d-----w- c:\documents and settings\zé\Dados de aplicativos\Spam Monitor

2009-12-22 04:18 . 2009-12-25 00:23 -------- d-----w- c:\arquivos de programas\Arquivos comuns\PC Tools

2009-12-22 04:18 . 2009-12-24 23:28 -------- d-----w- c:\arquivos de programas\PC Tools Internet Security

2009-12-18 23:51 . 2009-12-18 23:51 -------- d-----w- c:\documents and settings\zé\DoctorWeb

2009-12-18 03:12 . 2009-12-18 03:12 -------- d-----w- c:\arquivos de programas\TrendMicro

2009-12-18 00:01 . 2009-12-18 01:26 -------- d-----w- C:\2012 (2009) DVDRip XviD-MAXSPEED www.torentz.3xforum.ro

2009-12-17 21:52 . 2009-12-17 22:04 -------- d-----w- c:\arquivos de programas\Marcos Velasco Security

2009-12-16 21:45 . 2009-12-16 21:45 -------- d-----w- c:\documents and settings\Conta convidado\Dados de aplicativos\CyberLink

2009-12-16 04:19 . 2009-12-16 04:19 8 ----a-w- c:\windows\crpf.bin

2009-12-16 04:19 . 2009-12-16 04:19 4 ----a-w- c:\windows\crpf_sdum.bin

2009-12-15 20:16 . 2009-11-02 22:42 195456 ------w- c:\windows\system32\MpSigStub.exe

2009-12-13 22:25 . 2009-12-13 22:25 -------- d-----r- C:\Sandbox

2009-12-13 22:23 . 2009-12-16 23:32 -------- d-----w- c:\arquivos de programas\Sandboxie

2009-12-12 08:29 . 2009-12-12 08:29 428985 ----a-w- c:\windows\cscmondump.bin

2009-12-12 06:31 . 2009-12-12 06:31 -------- d--h--w- c:\windows\PIF

2009-12-11 22:11 . 2009-10-19 08:47 13824 ----a-w- c:\windows\system32\cnat.exe

2009-12-11 22:11 . 2009-10-27 17:46 132424 ----a-w- c:\windows\system32\drivers\CFRMD.sys

2009-12-11 22:11 . 2009-12-24 23:59 -------- d-----w- c:\arquivos de programas\COMODO

2009-12-11 20:21 . 2009-12-11 20:22 -------- d-----w- c:\arquivos de programas\Open Subtitle Editor

2009-12-06 20:35 . 2009-12-06 20:35 4844296 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2009-12-02 01:26 . 2009-12-02 02:01 -------- d-----w- C:\prob

2009-11-29 21:29 . 2009-12-26 20:55 -------- d-----w- C:\LinhaDefensiva

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-12-28 05:38 . 2009-11-02 02:10 149014560 --sha-w- c:\windows\system32\drivers\fidbox.dat

2009-12-28 05:06 . 2009-11-02 02:10 1744544 --sha-w- c:\windows\system32\drivers\fidbox.idx

2009-12-28 03:59 . 2009-09-06 04:11 -------- d-----w- c:\documents and settings\zé\Dados de aplicativos\dvdcss

2009-12-28 03:57 . 2009-09-09 19:50 -------- d-----w- c:\documents and settings\zé\Dados de aplicativos\Vso

2009-12-27 06:22 . 2009-09-06 07:18 -------- d-----w- c:\documents and settings\zé\Dados de aplicativos\uTorrent

2009-12-25 00:23 . 2009-11-16 01:55 -------- d-----w- c:\arquivos de programas\Spyware Doctor

2009-12-25 00:22 . 2009-11-16 20:52 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\PC Tools

2009-12-25 00:22 . 2009-09-19 20:51 -------- d---a-w- c:\documents and settings\All Users\Dados de aplicativos\Temp

2009-12-23 21:28 . 2009-11-15 22:24 -------- d-----w- c:\arquivos de programas\WYSIWYG Web Builder 6

2009-12-23 20:45 . 2009-09-06 02:28 -------- d-----w- c:\arquivos de programas\CyberLink DVD Solution

2009-12-23 20:45 . 2009-09-05 06:04 -------- d--h--w- c:\arquivos de programas\InstallShield Installation Information

2009-12-23 19:54 . 2001-10-28 15:07 82988 ----a-w- c:\windows\system32\perfc016.dat

2009-12-23 19:54 . 2001-10-28 15:07 477230 ----a-w- c:\windows\system32\perfh016.dat

2009-12-22 20:03 . 2009-11-19 20:04 -------- d-----w- c:\documents and settings\LocalService\Dados de aplicativos\PCToolsFirewallPlus

2009-12-20 05:53 . 2009-10-02 03:42 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\NOS

2009-12-20 05:52 . 2009-10-02 03:42 -------- d-----w- c:\arquivos de programas\NOS

2009-12-19 03:29 . 2009-09-05 19:12 -------- d-----w- c:\arquivos de programas\eMule

2009-12-11 21:27 . 2009-10-31 20:25 -------- d-----w- c:\arquivos de programas\CCleaner

2009-12-11 20:10 . 2009-10-03 20:27 -------- d-----w- c:\arquivos de programas\URUSoft

2009-12-09 17:03 . 2009-09-06 02:11 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\GbPlugin

2009-12-09 17:03 . 2009-09-06 02:11 -------- d-----w- c:\arquivos de programas\GbPlugin

2009-12-08 00:40 . 2009-09-06 01:05 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2009-12-07 17:30 . 2009-09-06 02:12 30752 ----a-w- c:\windows\system32\drivers\gbpkm.sys

2009-12-06 20:35 . 2009-11-12 23:44 -------- d-----w- c:\arquivos de programas\Malwarebytes' Anti-Malware

2009-12-03 18:14 . 2009-11-12 23:44 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-12-03 18:13 . 2009-11-12 23:44 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-11-21 15:58 . 2004-08-04 03:45 471552 ----a-w- c:\windows\AppPatch\aclayers.dll

2009-11-19 20:13 . 2009-09-14 03:46 -------- d-----w- c:\arquivos de programas\Windows Live

2009-11-19 20:12 . 2009-11-19 20:12 -------- d-----w- c:\arquivos de programas\Microsoft SQL Server Compact Edition

2009-11-19 20:10 . 2009-11-19 20:10 -------- d-----w- c:\arquivos de programas\Microsoft

2009-11-19 20:10 . 2009-11-19 20:10 -------- d-----w- c:\arquivos de programas\Windows Live SkyDrive

2009-11-19 20:04 . 2009-11-19 20:04 -------- d-----w- c:\documents and settings\LocalService\Dados de aplicativos\PCToolsSpamMonitorPlus

2009-11-19 20:02 . 2009-11-19 20:02 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Windows Live

2009-11-16 21:01 . 2009-11-16 21:01 -------- d-----w- c:\documents and settings\zé\Dados de aplicativos\PCToolsSpamMonitorPlus

2009-11-16 20:57 . 2009-10-19 04:22 -------- d-----w- c:\arquivos de programas\CheckPoint

2009-11-16 20:35 . 2009-10-19 04:22 4212 ---ha-w- c:\windows\system32\zllictbl.dat

2009-11-15 22:27 . 2009-11-15 22:28 737280 ----a-w- c:\windows\iun6002.exe

2009-11-15 20:44 . 2009-11-04 00:04 411368 ----a-w- c:\windows\system32\deploytk.dll

2009-11-15 20:44 . 2009-11-15 20:44 -------- d-----w- c:\arquivos de programas\Java

2009-11-15 19:41 . 2009-11-15 19:41 79488 ----a-w- c:\documents and settings\zé\Dados de aplicativos\Sun\Java\jre1.6.0_17\gtapi.dll

2009-11-12 19:24 . 2009-09-13 01:54 -------- d-----w- c:\arquivos de programas\WinClamAVShield

2009-11-08 04:56 . 2009-11-08 04:56 -------- d-----w- c:\arquivos de programas\MSBuild

2009-11-08 04:56 . 2009-11-08 04:56 -------- d-----w- c:\arquivos de programas\Reference Assemblies

2009-11-04 23:06 . 2009-11-04 23:06 -------- d-----w- c:\arquivos de programas\desktopTrader pro

2009-10-31 23:57 . 2009-09-06 03:08 -------- d-----w- c:\arquivos de programas\MPC HomeCinema

2009-10-31 20:17 . 2009-10-30 01:36 -------- d-----w- c:\arquivos de programas\WinScraper

2009-10-31 01:00 . 2009-10-24 22:29 -------- d-----w- c:\documents and settings\Conta convidado\Dados de aplicativos\Spyware Terminator

2009-10-29 13:08 . 2009-10-29 13:08 -------- d-----w- c:\documents and settings\Conta convidado\Dados de aplicativos\Malwarebytes

2009-10-29 07:42 . 2004-08-04 03:45 916480 ----a-w- c:\windows\system32\wininet.dll

2009-10-27 11:53 . 2009-10-27 11:53 8192 ----a-w- c:\windows\system32\CSC.exe

2009-10-21 05:39 . 2004-08-04 03:45 75776 ----a-w- c:\windows\system32\strmfilt.dll

2009-10-21 05:39 . 2004-08-04 03:45 25088 ----a-w- c:\windows\system32\httpapi.dll

2009-10-20 16:20 . 2004-08-04 02:00 265728 ----a-w- c:\windows\system32\drivers\http.sys

2009-10-13 10:34 . 2004-08-04 03:45 271360 ----a-w- c:\windows\system32\oakley.dll

2009-10-12 13:39 . 2004-08-04 03:45 150016 ----a-w- c:\windows\system32\rastls.dll

2009-10-12 13:39 . 2004-08-04 03:45 79872 ----a-w- c:\windows\system32\raschap.dll

2009-10-02 03:10 . 2009-10-02 03:10 0 ----a-w- c:\windows\nsreg.dat

2005-04-01 01:17 . 2009-09-06 02:28 40960 ----a-w- c:\arquivos de programas\Uninstall_CDS.exe

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\arquivos de programas\Arquivos comuns\Ahead\lib\NMBgMonitor.exe" [2006-03-01 90112]

"RamBooster"="c:\arquivos de programas\RamBooster 2.0\Rambooster.exe" [2005-11-17 561664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SoundMan"="SOUNDMAN.EXE" [2005-10-24 90112]

"ATICCC"="c:\arquivos de programas\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056]

"avgnt"="c:\arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"RemoteControl9"="c:\arquivos de programas\CyberLink\PowerDVD9\PDVD9Serv.exe" [2009-02-16 87336]

"BDRegion"="c:\arquivos de programas\Cyberlink\Shared Files\brs.exe" [2009-02-28 75048]

"SmartDefrag"="c:\arquivos de programas\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" [2009-07-02 2453264]

"RemoteControl"="c:\arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2003-12-08 32768]

"SunJavaUpdateSched"="c:\arquivos de programas\Java\jre6\bin\jusched.exe" [2009-11-15 149280]

"mylbx"="c:\arquivos de programas\My Lockbox\mylbx.exe" [2009-08-20 1075888]

"COMODO Internet Security"="c:\arquivos de programas\COMODO\COMODO Internet Security\cfp.exe" [2009-12-25 1800464]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\system32\guard32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

2008-04-14 02:20 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

2006-01-12 18:40 155648 ----a-w- c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVD9LanguageShortcut]

2008-10-13 23:41 50472 ------w- c:\arquivos de programas\CyberLink\PowerDVD9\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2009-11-11 01:08 417792 ----a-w- c:\arquivos de programas\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]

2006-11-03 21:20 866584 ----a-w- c:\arquivos de programas\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\eMule\\emule.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Arquivos de programas\\uTorrent\\uTorrent.exe"=

"c:\\Arquivos de programas\\RadLight Company\\RadLight 4.0\\rlkernel.exe"=

"c:\\Arquivos de programas\\Messenger\\msmsgs.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Arquivos de programas\\Windows Live\\Sync\\WindowsLiveSync.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"54662:TCP"= 54662:TCP:Emule tcp

"54672:UDP"= 54672:UDP:emule udp

R0 CFRMD;cfrmd;c:\windows\system32\drivers\CFRMD.sys [11/12/2009 20:11 132424]

R0 FSProFilter;FSPro File Filter;c:\windows\system32\drivers\FSPFltd.sys [24/12/2009 02:16 43792]

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [12/9/2009 03:05 28544]

R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [24/12/2009 22:00 133064]

R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [24/12/2009 22:00 25160]

R1 is-62GJNdrv;is-62GJNdrv;c:\windows\system32\drivers\14832250.sys [2/11/2009 00:10 148496]

R1 is-P60FPdrv;is-P60FPdrv;c:\windows\system32\drivers\72099101.sys [8/11/2009 21:40 148496]

R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2009/09/19 17:53];c:\arquivos de programas\CyberLink\PowerDVD9\000.fcl [28/2/2009 20:40 87536]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\arquivos de programas\Avira\AntiVir Desktop\sched.exe [12/9/2009 23:35 108289]

R2 fsproflt;FSPro Filter Service;c:\windows\system32\fsproflt.exe [24/12/2009 02:16 73392]

R2 GbpSv;Gbp Service;c:\arquiv~1\GbPlugin\GbpSv.exe [6/9/2009 00:11 54048]

R2 Prvflder;Prvflder;c:\windows\system32\drivers\prvflder.sys [21/4/2006 08:22 70912]

R2 SBKUPNT;SBKUPNT;c:\windows\system32\drivers\SBKUPNT.SYS [5/9/2009 07:23 14976]

R2 WinDefend;Windows Defender;c:\arquivos de programas\Windows Defender\MsMpEng.exe [3/11/2006 19:19 13592]

S0 GbpKm;Gbp KernelMode;c:\windows\system32\drivers\gbpkm.sys [6/9/2009 00:12 30752]

S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys --> c:\windows\system32\drivers\TfFsMon.sys [?]

S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys --> c:\windows\system32\drivers\TfSysMon.sys [?]

S3 TfNetMon;TfNetMon; [x]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

getPlusHelper REG_MULTI_SZ getPlusHelper

.

------- Scan Suplementar -------

.

uStart Page = hxxp://www.google.com.br/

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

TCP: {AA30E960-20B3-4F84-8593-1B2150AB47EA} = 201.21.192.116

DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} - hxxps://www14.bancobrasil.com.br/plugin/GbpDist.cab

FF - ProfilePath - c:\documents and settings\zé\Dados de aplicativos\Mozilla\Firefox\Profiles\j1uhx1y0.default\

FF - component: c:\documents and settings\zé\Dados de aplicativos\Mozilla\Firefox\Profiles\j1uhx1y0.default\extensions\{87F8774F-B485-47E2-A755-A40A8A5E886C}\components\GbMzhBb.dll

FF - plugin: c:\arquivos de programas\Windows Live\Photo Gallery\NPWLPG.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-12-28 03:37

Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{B154377D-700F-42cc-9474-23858FBDF4BD}]

"ImagePath"="\??\c:\arquivos de programas\CyberLink\PowerDVD9\000.fcl"

.

--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•6~*]

"6140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'winlogon.exe'(612)

c:\windows\system32\guard32.dll

c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(668)

c:\windows\system32\guard32.dll

- - - - - - - > 'explorer.exe'(3576)

c:\windows\system32\WININET.dll

c:\arquivos de programas\Microsoft Private Folder 1.0\ShellExt.dll

c:\windows\system32\PFLib.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Tempo para conclusão: 2009-12-28 03:40:43

ComboFix-quarantined-files.txt 2009-12-28 05:40

ComboFix2.txt 2009-12-22 03:08

Pré-execução: 17 pasta(s) 181.299.142.656 bytes disponíveis

Pós execução: 18 pasta(s) 181.526.810.624 bytes disponíveis

- - End Of File - - 0D8D02C1F44438D1E358EB1BCF1CE825

Logfile of Trend Micro HijackThis v2.0.3 (BETA)

Scan saved at 03:48:45, on 28/12/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\ARQUIV~1\GbPlugin\GbpSv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\COMODO\COMODO Internet Security\cmdagent.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Windows Defender\MsMpEng.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe

C:\WINDOWS\system32\fsproflt.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Arquivos de programas\ATI Technologies\ATI.ACE\cli.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe

C:\Arquivos de programas\CyberLink\PowerDVD9\PDVD9Serv.exe

C:\Arquivos de programas\Cyberlink\Shared Files\brs.exe

C:\Arquivos de programas\IObit\IObit SmartDefrag\IObit SmartDefrag.exe

C:\Arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe

C:\Arquivos de programas\Java\jre6\bin\jusched.exe

C:\Arquivos de programas\My Lockbox\mylbx.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\lib\NMBgMonitor.exe

C:\Arquivos de programas\ATI Technologies\ATI.ACE\cli.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\internet explorer\iexplore.exe