Edvan 30 Denunciar post Postado Janeiro 15, 2010 Malwarebytes' Anti-Malware 1.44 Versão do banco de dados: 3566 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 15/1/2010 00:44:22 mbam-log-2010-01-15 (00-44-22).txt Tipo de Verificação: Completa (C:\|D:\|) Objetos verificados: 147887 Tempo decorrido: 17 minute(s), 34 second(s) Processos da Memória infectados: 0 Módulos de Memória Infectados: 1 Chaves do Registro infectadas: 0 Valores do Registro infectados: 0 Ítens do Registro infectados: 0 Pastas infectadas: 0 Arquivos infectados: 3 Processos da Memória infectados: (Nenhum ítem malicioso foi detectado) Módulos de Memória Infectados: C:\WINDOWS\system32\28463\GBKH.007 (PUP.ArdamaxKeyLogger) -> Delete on reboot. Chaves do Registro infectadas: (Nenhum ítem malicioso foi detectado) Valores do Registro infectados: (Nenhum ítem malicioso foi detectado) Ítens do Registro infectados: (Nenhum ítem malicioso foi detectado) Pastas infectadas: (Nenhum ítem malicioso foi detectado) Arquivos infectados: C:\WINDOWS\system32\28463\GBKH.007 (PUP.ArdamaxKeyLogger) -> Delete on reboot. C:\WINDOWS:wins32 (Rootkit.ADS) -> Quarantined and deleted successfully. C:\WINDOWS\ktd32.atm (Backdoor.ProRat) -> Quarantined and deleted successfully. So chego a noite em casa, e quando vou ver meu pc parece uma fazenda de virus.. O Kaspersky Internet Security 2009 pegou muitos virus, veja: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:58:21, on 15/1/2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Arquivos de programas\Java\jre6\bin\jqs.exe C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe C:\Arquivos de programas\TeamViewer\Version4\TeamViewer.exe C:\WINDOWS\RTHDCPL.EXE C:\Arquivos de programas\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxsrvc.exe C:\WINDOWS\system32\28463\GBKH.exe C:\WINDOWS\system32\ctfmon.exe C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Arquivos de programas\Messenger\msmsgs.exe C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexStoreSvr.exe C:\Arquivos de programas\Mozilla Firefox\firefox.exe C:\HiJackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Arquivos de programas\Free Download Manager\iefdm2.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll O4 - HKLM\..\Run: [AVP] "C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [GBKH Agent] C:\WINDOWS\system32\28463\GBKH.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] "C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Free Download Manager] "C:\Arquivos de programas\Free Download Manager\fdm.exe" -autorun O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: "Adicionar ao Bloqueador de banner de anúncio" - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm O8 - Extra context menu item: Baixar com o Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dllink.htm O8 - Extra context menu item: Baixar tudo com o Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlall.htm O8 - Extra context menu item: Baixar vídeo com o Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlfvideo.htm O8 - Extra context menu item: Download selecionado pelo Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlselected.htm O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Google Sidewiki... - res://C:\Arquivos de programas\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_5F1A57F0B9B89E2E.dll/cmsidewiki.html O9 - Extra button: Estatísticas de proteção de tráfego da web - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab O20 - AppInit_DLLs: C:\ARQUIV~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\ARQUIV~1\KASPER~1\KASPER~1\adialhk.dll,C:\ARQUIV~1\KASPER~1\KASPER~1\kloehk.dll O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Arquivos de programas\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe -- End of file - 8159 bytes Compartilhar este post Link para o post Compartilhar em outros sites
jgarcia 1 Denunciar post Postado Janeiro 15, 2010 Opa Edvan, Baixe o ComboFix em: ComboFix 1) Desabilite o seu anti-vírus temporariamente; 2) Dê um duplo-clique no combofix.exe e aguarde (o processo total demora cerca de 10 minutos); 3) A janela de “NEGAÇÃO DE GARANTIA DO SOFTWARE” abrir-se-á. Leia atentamente o texto contido nesta janela e clique sobre “SIM” para continuar. PS.: Caso não concorde com os termos clique sobre “NÃO” para sair do software, cabendo lembrar que o processo de desinfecção não será possível sem a continuidade do ComboFix. 4) Outra janela irá abrir, caso a sua máquina não possua o CONSOLE DE RECUPERAÇÃO DO WINDOWS. É recomendável executar a instalação do console ante de dar continuidade ao processo, pois tal ação proporcionará a garantia de que o sistema poderá ser recuperado em caso de problemas durante a varredura. Clique sobre “SIM” e aguarde, pois o processo de instalação do console dar-se-á automaticamente através do próprio ComboFix. Ele poderá demorar alguns minutos (dependerá da velocidade de sua conexão), portanto seja paciente. Quando a janela “INSTALANDO O CONSOLE DE RECUPERAÇÃO” aparecer clique em “OK”, depois clique sobre “SIM” para aceitar a licença EULA. Ao término da instalação do console de recuperação abrir-se-á uma janela avisando que “O CONSOLE DE RECUPERAÇÃO FOI INSTALADA COM SUCESSO”. Clique sobre “SIM” para continuar a varredura. 5) O ComboFix iniciará o AUTOSCAN (aguarde). ATENÇÃO: Não clique na janela do ComboFix, nem termine o processo abruptamente enquanto a ferramenta estiver sendo executada, pois isto implicará na desconfiguração de seu desktop (ele ficará todo branco). Ao término do processo a máquina será reiniciada para a emissão do relatório. 6) Ao reiniciar a máquina o ComboFix irá executar o FIND3M para a criação do relatório final da varredura. O log ficará alocado em C:\ComboFix.txt. 7) Reabilite o seu anti-vírus; 8) Preciso que você cole o conteúdo do ComboFix.txt em sua próxima resposta. OBS.1: Caso apareça uma mensagem avisando que ESTE NÃO É UM APLICATIVO WIN 32 VÁLIDO baixe o ComboFix novamente, mas salve-o em seu Desktop como KomboFix. Em último caso, tente utilizar o ComboFix em MODO SEGURO. OBS.2: Caso haja um clique sobre a janela do ComboFix em execução, ela irá MAXIMIZAR, sobrepondo-se sobre as demais. Para minimizá-la novamente basta utilizar a combinação ALT + TAB. Abraços. Compartilhar este post Link para o post Compartilhar em outros sites
Edvan 30 Denunciar post Postado Janeiro 15, 2010 ComboFix 10-01-15.01 - Edvan 15/01/2010 22:34:35.1.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.2036.1434 [GMT -3:00] Executando de: c:\documents and settings\Edvan\Desktop\ComboFix.exe AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0} FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0} . ((((((((((((((((((((((((((((((((((((( Outras Exclusões ))))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\28463 c:\windows\system32\28463\AKV.exe c:\windows\system32\28463\GBKH.001 c:\windows\system32\28463\GBKH.002 c:\windows\system32\28463\GBKH.002.tmp c:\windows\system32\28463\GBKH.005 c:\windows\system32\28463\GBKH.006 c:\windows\system32\28463\GBKH.009 c:\windows\system32\28463\GBKH.009.tmp c:\windows\system32\28463\GBKH.exe c:\windows\system32\28463\Jan_15_2010__22_34_11.jpg . (((((((((((((((( Arquivos/Ficheiros criados de 2009-12-16 to 2010-01-16 )))))))))))))))))))))))))))) . 2010-01-15 17:21 . 2010-01-15 17:21 2560 ----a-w- c:\windows\_MSRSTRT.EXE 2010-01-15 04:10 . 2009-03-27 04:16 12672 ----a-w- c:\windows\system32\drivers\cpuz132_x32.sys 2010-01-15 04:10 . 2010-01-15 04:10 -------- d-----w- c:\arquivos de programas\CPUID 2010-01-15 03:15 . 2010-01-15 03:15 5115824 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe 2010-01-15 02:08 . 2007-11-18 19:43 19952 ----a-w- c:\documents and settings\Default User\Dados de aplicativos\Kill.exe 2010-01-15 01:56 . 2010-01-15 01:56 -------- d-----w- C:\Downloads 2010-01-14 01:23 . 2010-01-16 01:37 -------- d-----w- c:\documents and settings\Edvan\Dados de aplicativos\Free Download Manager 2010-01-14 01:23 . 2010-01-14 01:23 -------- d-----w- c:\arquivos de programas\Free Download Manager 2010-01-14 01:23 . 2010-01-14 01:23 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\FreeDownloadManager.ORG 2010-01-12 20:51 . 2009-11-21 15:58 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll 2010-01-06 22:17 . 2010-01-06 22:17 -------- d-----w- c:\documents and settings\Edvan\Dados de aplicativos\Ahead 2010-01-06 22:16 . 2010-01-06 22:16 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Ahead 2010-01-06 22:15 . 2010-01-06 22:16 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Ahead 2010-01-06 22:15 . 2010-01-06 22:15 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Nero 2010-01-06 22:15 . 2010-01-06 22:15 -------- d-----w- c:\arquivos de programas\Nero 2010-01-06 14:26 . 2010-01-06 14:26 -------- d-----w- c:\arquivos de programas\Stardock 2010-01-06 14:26 . 2008-04-26 18:14 42672 ------w- c:\windows\system32\wbsys.dll 2010-01-06 14:22 . 2010-01-06 14:22 79488 ----a-w- c:\documents and settings\Edvan\Dados de aplicativos\Sun\Java\jre1.6.0_17\gtapi.dll 2010-01-06 10:45 . 2008-05-09 10:55 180224 -c----w- c:\windows\system32\dllcache\scrobj.dll 2010-01-06 10:45 . 2008-05-09 10:55 172032 -c----w- c:\windows\system32\dllcache\scrrun.dll 2010-01-06 10:45 . 2008-05-09 10:55 90112 -c----w- c:\windows\system32\dllcache\wshext.dll 2010-01-06 10:45 . 2008-05-09 08:45 135168 -c----w- c:\windows\system32\dllcache\cscript.exe 2010-01-06 10:45 . 2008-05-08 11:24 155648 -c----w- c:\windows\system32\dllcache\wscript.exe 2010-01-05 23:13 . 2004-08-04 03:45 221184 ----a-w- c:\windows\system32\wmpns.dll 2010-01-05 22:56 . 2010-01-05 22:56 -------- d-----w- c:\windows\system32\bits 2010-01-05 22:56 . 2010-01-05 22:56 -------- d-----w- c:\windows\l2schemas 2010-01-03 21:18 . 2010-01-03 21:18 411368 ----a-w- c:\windows\system32\deploytk.dll 2010-01-03 21:18 . 2010-01-03 21:18 -------- d-----w- c:\arquivos de programas\Java 2010-01-03 21:17 . 2010-01-03 21:17 152576 ----a-w- c:\documents and settings\Edvan\Dados de aplicativos\Sun\Java\jre1.6.0_16\lzma.dll 2010-01-02 00:06 . 2010-01-02 00:06 -------- d-----w- c:\documents and settings\Edvan\Dados de aplicativos\Malwarebytes 2010-01-02 00:06 . 2010-01-07 19:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-01-02 00:06 . 2010-01-07 19:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-01-02 00:06 . 2010-01-02 00:06 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes 2010-01-02 00:06 . 2010-01-15 03:16 -------- d-----w- c:\arquivos de programas\Malwarebytes' Anti-Malware 2010-01-02 00:05 . 2010-01-02 00:05 -------- d-----w- C:\backups 2010-01-01 22:40 . 2010-01-15 04:01 -------- d---a-w- c:\documents and settings\All Users\Dados de aplicativos\TEMP 2010-01-01 22:40 . 2010-01-15 03:59 -------- d-----w- c:\arquivos de programas\SpywareBlaster 2010-01-01 22:39 . 2010-01-01 22:39 -------- d-----w- c:\documents and settings\Edvan\Dados de aplicativos\Auslogics 2010-01-01 22:39 . 2010-01-01 22:39 -------- d-----w- c:\arquivos de programas\Auslogics 2010-01-01 22:37 . 2010-01-01 22:38 -------- d-----w- c:\arquivos de programas\Marcos Velasco Security 2010-01-01 20:43 . 2010-01-01 20:43 401720 ----a-w- C:\HiJackThis.exe 2010-01-01 18:26 . 2010-01-01 18:26 -------- d-----w- c:\documents and settings\Edvan\Dados de aplicativos\Thinstall 2010-01-01 14:16 . 2010-01-01 14:16 -------- d-----w- c:\arquivos de programas\ESET 2009-12-31 20:53 . 2010-01-15 04:04 -------- d-sh--w- c:\documents and settings\Edvan\IECompatCache 2009-12-31 20:53 . 2010-01-15 04:04 -------- d-sh--w- c:\documents and settings\Edvan\PrivacIE 2009-12-31 20:52 . 2010-01-01 22:44 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache 2009-12-31 20:52 . 2010-01-15 09:54 -------- d-sh--w- c:\documents and settings\Edvan\IETldCache 2009-12-31 20:49 . 2009-10-29 07:42 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll 2009-12-31 20:49 . 2009-10-29 07:42 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll 2009-12-31 20:49 . 2009-10-29 07:42 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll 2009-12-31 20:49 . 2009-10-29 07:42 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll 2009-12-31 20:49 . 2009-10-29 07:42 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll 2009-12-31 20:49 . 2009-10-29 07:42 11069952 -c----w- c:\windows\system32\dllcache\ieframe.dll 2009-12-31 20:49 . 2009-12-31 20:49 -------- d-----w- c:\windows\ie8updates 2009-12-31 20:48 . 2009-10-02 04:44 92160 -c----w- c:\windows\system32\dllcache\iecompat.dll 2009-12-31 20:47 . 2010-01-05 22:56 -------- d-----w- c:\windows\system32\pt-BR 2009-12-31 20:47 . 2009-12-31 20:48 -------- dc-h--w- c:\windows\ie8 2009-12-31 01:31 . 2004-08-04 02:36 701440 ------w- c:\windows\system32\drivers\ati2mtag.sys 2009-12-31 00:23 . 2009-12-31 00:23 -------- d-----w- c:\arquivos de programas\Google 2009-12-31 00:16 . 2009-12-31 00:16 -------- d-----w- c:\documents and settings\LocalService\Dados de aplicativos\TeamViewer 2009-12-30 23:47 . 2010-01-05 22:54 -------- d-----w- c:\windows\ServicePackFiles 2009-12-30 22:44 . 2009-12-30 22:44 -------- d-----w- c:\documents and settings\Edvan\Dados de aplicativos\Media Player Classic 2009-12-30 22:35 . 2009-02-06 10:10 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe 2009-12-30 22:35 . 2009-06-25 08:27 732672 -c----w- c:\windows\system32\dllcache\lsasrv.dll 2009-12-30 22:35 . 2009-03-06 14:20 286208 -c----w- c:\windows\system32\dllcache\pdh.dll 2009-12-30 22:35 . 2009-02-09 11:25 111104 -c----w- c:\windows\system32\dllcache\services.exe 2009-12-30 22:35 . 2009-02-09 10:53 730624 -c----w- c:\windows\system32\dllcache\ntdll.dll 2009-12-30 22:35 . 2009-02-09 10:53 683520 -c----w- c:\windows\system32\dllcache\advapi32.dll 2009-12-30 22:35 . 2009-02-09 10:53 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll 2009-12-30 22:35 . 2009-02-09 10:53 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll 2009-12-30 22:35 . 2009-02-09 10:53 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll 2009-12-30 22:11 . 2008-12-11 10:57 333952 -c----w- c:\windows\system32\dllcache\srv.sys 2009-12-30 21:47 . 2009-12-30 22:18 -------- d-----w- c:\documents and settings\Edvan\Dados de aplicativos\TeamViewer 2009-12-30 21:47 . 2009-12-30 21:47 -------- d-----w- c:\arquivos de programas\TeamViewer 2009-12-30 21:45 . 2009-12-30 21:45 -------- d-----w- c:\documents and settings\Edvan\temp 2009-12-30 21:42 . 2008-10-15 16:36 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll 2009-12-30 21:35 . 2008-04-21 21:15 216064 -c----w- c:\windows\system32\dllcache\wordpad.exe 2009-12-30 21:27 . 2008-04-14 02:20 26624 ----a-w- c:\documents and settings\LocalService\Dados de aplicativos\Microsoft\UPnP Device Host\upnphost\udhisapi.dll 2009-12-30 19:35 . 2009-12-30 19:35 -------- d-----w- c:\arquivos de programas\DsNET Corp 2009-12-30 03:30 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll 2009-12-30 03:22 . 2009-08-04 17:27 2070272 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe 2009-12-30 03:22 . 2009-08-04 17:27 2149376 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe 2009-12-30 03:22 . 2009-08-04 17:27 2028032 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe 2009-12-30 03:14 . 2008-10-24 11:21 455296 -c----w- c:\windows\system32\dllcache\mrxsmb.sys 2009-12-30 03:12 . 2008-04-11 19:05 691712 -c----w- c:\windows\system32\dllcache\inetcomm.dll 2009-12-30 03:10 . 2008-06-14 17:34 272384 -c----w- c:\windows\system32\dllcache\bthport.sys 2009-12-30 03:10 . 2008-06-14 17:34 272384 ------w- c:\windows\system32\drivers\bthport.sys 2009-12-30 03:07 . 2009-12-30 03:07 -------- d-----w- c:\arquivos de programas\Windows Media Connect 2 2009-12-30 03:05 . 2009-12-30 03:06 -------- d-----w- c:\windows\system32\drivers\UMDF 2009-12-30 03:05 . 2009-12-30 03:05 -------- d-----w- c:\windows\system32\LogFiles 2009-12-30 03:05 . 2008-05-08 14:02 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys 2009-12-30 02:50 . 2010-01-13 19:43 -------- d--h--w- c:\windows\$hf_mig$ 2009-12-30 02:34 . 2009-12-30 02:34 109072 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\mzvkbd3.dll 2009-12-30 02:34 . 2009-12-30 02:34 59920 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\mzvkbd.dll 2009-12-30 02:34 . 2009-12-30 02:34 208616 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\avp.exe 2009-12-30 02:34 . 2009-12-30 02:34 33808 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\klbg.sys 2009-12-30 02:34 . 2009-12-30 02:34 226832 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\XP\klif.sys 2009-12-29 02:45 . 2009-12-30 02:35 95259 ----a-w- c:\windows\system32\drivers\klick.dat 2009-12-29 02:45 . 2009-12-30 02:35 108059 ----a-w- c:\windows\system32\drivers\klin.dat 2009-12-29 02:44 . 2010-01-16 01:38 360480 --sha-w- c:\windows\system32\drivers\fidbox2.dat 2009-12-29 02:44 . 2010-01-16 01:38 1566240 --sha-w- c:\windows\system32\drivers\fidbox.dat 2009-12-29 02:44 . 2010-01-15 21:54 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab 2009-12-29 02:44 . 2009-12-29 02:44 -------- d-----w- c:\arquivos de programas\Kaspersky Lab 2009-12-29 02:02 . 2003-06-19 03:31 18944 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll 2009-12-29 02:02 . 2003-06-19 03:31 17920 ----a-w- c:\windows\system32\mdimon.dll 2009-12-29 02:02 . 2009-12-29 02:02 -------- d-----w- c:\arquivos de programas\Microsoft.NET 2009-12-29 02:02 . 2009-12-29 02:02 -------- d-----w- c:\windows\SHELLNEW 2009-12-29 01:57 . 2009-12-29 01:57 -------- d-----r- C:\MSOCache 2009-12-29 01:57 . 2009-12-29 01:57 -------- d-----w- c:\arquivos de programas\CCleaner 2009-12-29 01:41 . 2010-01-16 00:23 -------- d-----w- c:\documents and settings\Edvan\Tracing 2009-12-29 01:40 . 2009-12-29 01:40 -------- d-----w- c:\arquivos de programas\Microsoft 2009-12-29 01:39 . 2009-12-29 01:39 -------- d-----w- c:\arquivos de programas\Windows Live SkyDrive 2009-12-29 01:39 . 2009-12-29 01:40 -------- d-----w- c:\arquivos de programas\Windows Live 2009-12-29 01:07 . 2009-12-29 01:07 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Windows Live 2009-12-29 00:55 . 2009-12-29 00:55 0 ----a-w- c:\windows\nsreg.dat 2009-12-29 00:53 . 2009-12-29 00:54 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Adobe 2009-12-29 00:21 . 2010-01-15 12:12 -------- d-sh--w- c:\documents and settings\Edvan\UserData 2009-12-28 23:09 . 2009-04-15 16:32 715520 ----a-w- c:\windows\system32\drivers\rt2870.sys 2009-12-28 23:09 . 2009-04-15 16:31 221184 ----a-w- c:\windows\system32\RaCoInst.dll 2009-12-28 23:09 . 2009-04-15 16:31 13931 ----a-w- c:\windows\system32\RaCoInst.dat 2009-12-28 23:07 . 2008-01-16 01:12 180224 ----a-r- c:\windows\system32\igfxres.dll 2009-12-28 23:04 . 2008-04-14 02:20 4096 ----a-w- c:\windows\system32\ksuser.dll 2009-12-28 23:02 . 2008-01-16 01:12 98944 ----a-r- c:\windows\system32\drivers\Rtenicxp.sys . ((((((((((((((((((((((((((((((((((((( Relatório Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-01-16 01:38 . 2009-12-29 02:44 3360 --sha-w- c:\windows\system32\drivers\fidbox2.idx 2010-01-16 01:38 . 2009-12-29 02:44 14364 --sha-w- c:\windows\system32\drivers\fidbox.idx 2010-01-14 10:33 . 2001-10-28 15:07 48628 ----a-w- c:\windows\system32\perfc016.dat 2010-01-14 10:33 . 2001-10-28 15:07 344380 ----a-w- c:\windows\system32\perfh016.dat 2010-01-13 01:24 . 2009-12-28 23:02 -------- d--h--w- c:\arquivos de programas\InstallShield Installation Information 2010-01-13 01:24 . 2009-12-28 23:04 -------- d-----w- c:\arquivos de programas\Arquivos comuns\InstallShield 2009-12-30 22:43 . 2009-12-30 22:42 -------- d-----w- c:\arquivos de programas\K-Lite Codec Pack 2009-12-30 09:11 . 2009-12-28 22:53 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat 2009-12-30 02:35 . 2008-01-29 19:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys 2009-12-28 23:04 . 2009-12-28 23:02 -------- d-----w- c:\arquivos de programas\Realtek 2009-12-28 23:04 . 2009-12-28 23:04 315392 ----a-w- c:\windows\HideWin.exe 2009-12-28 23:02 . 2009-12-28 23:02 -------- d-----w- c:\documents and settings\Edvan\Dados de aplicativos\InstallShield 2009-12-28 22:59 . 2009-12-28 22:59 -------- d-----w- c:\arquivos de programas\Intel 2009-12-28 22:58 . 2009-12-28 22:58 -------- d-----w- c:\arquivos de programas\MSXML 4.0 2009-12-28 22:53 . 2009-12-28 22:53 -------- d-----w- c:\arquivos de programas\microsoft frontpage 2009-12-28 22:52 . 2009-12-28 22:52 -------- d-----w- c:\arquivos de programas\Serviços on-line 2009-12-28 22:51 . 2009-12-28 22:51 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Serviços 2009-12-28 22:50 . 2009-12-28 22:50 21844 ----a-w- c:\windows\system32\emptyregdb.dat 2009-12-11 18:00 . 2009-12-30 22:42 85504 ----a-w- c:\windows\system32\ff_vfw.dll 2009-11-21 15:58 . 2004-08-04 03:45 471552 ----a-w- c:\windows\AppPatch\aclayers.dll 2009-10-29 07:42 . 2004-08-04 03:45 916480 ----a-w- c:\windows\system32\wininet.dll 2009-10-21 05:39 . 2004-08-04 03:45 75776 ----a-w- c:\windows\system32\strmfilt.dll 2009-10-21 05:39 . 2004-08-04 03:45 25088 ----a-w- c:\windows\system32\httpapi.dll 2009-10-20 16:20 . 2004-08-04 02:00 265728 ----a-w- c:\windows\system32\drivers\http.sys . (((((((((((((((((((((((((( Pontos de Carregamento do Registro ))))))))))))))))))))))))))))))))))))))) . . *Nota* entradas vazias e legítimas por defeito não são mostradas. REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-12-31 39408] "MSMSGS"="c:\arquivos de programas\Messenger\msmsgs.exe" [2008-04-14 1695232] "msnmsgr"="c:\arquivos de programas\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872] "Free Download Manager"="c:\arquivos de programas\Free Download Manager\fdm.exe" [2009-01-31 3399727] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2008-01-16 16384512] "SunJavaUpdateSched"="c:\arquivos de programas\Java\jre6\bin\jusched.exe" [2010-01-03 149280] "Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-16 137752] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-16 141848] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-16 166424] "Adobe Reader Speed Launcher"="c:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696] "Adobe ARM"="c:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288] "NeroFilterCheck"="c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136] "AVP"="c:\arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-12-30 208616] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKLM\~\startupfolder\C:^Documents and Settings^Edvan^Menu Iniciar^Programas^Inicializar^LimeWire On Startup.lnk] backup=c:\windows\pss\LimeWire On Startup.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] 2007-06-27 21:03 152872 ----a-w- c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Arquivos de programas\\TeamViewer\\Version4\\TeamViewer.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/1/2008 16:29 33808] R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [15/1/2010 01:10 12672] R2 TeamViewer4;TeamViewer 4;c:\arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe [7/10/2009 09:50 185640] R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/3/2008 17:02 26640] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/4/2008 16:06 24592] S0 tctolw;tctolw;c:\windows\system32\drivers\ntups.sys --> c:\windows\system32\drivers\ntups.sys [?] S2 gupdate;Google Update Service (gupdate);c:\arquivos de programas\Google\Update\GoogleUpdate.exe [30/12/2009 21:23 135664] S3 rt2870;D-Link 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [28/12/2009 20:09 715520] . Conteúdo da pasta 'Tarefas Agendadas' 2010-01-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\arquivos de programas\Google\Update\GoogleUpdate.exe [2009-12-31 00:23] 2010-01-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\arquivos de programas\Google\Update\GoogleUpdate.exe [2009-12-31 00:23] 2010-01-16 c:\windows\Tasks\User_Feed_Synchronization-{B9C08FFF-A2EE-49BC-A623-5061B828FBFD}.job - c:\windows\system32\msfeedssync.exe [2009-03-08 06:31] . . ------- Scan Suplementar ------- . uStart Page = hxxp://www.google.com.br/ uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Baixar com o Free Download Manager - file://c:\arquivos de programas\Free Download Manager\dllink.htm IE: Baixar tudo com o Free Download Manager - file://c:\arquivos de programas\Free Download Manager\dlall.htm IE: Baixar vídeo com o Free Download Manager - file://c:\arquivos de programas\Free Download Manager\dlfvideo.htm IE: Download selecionado pelo Free Download Manager - file://c:\arquivos de programas\Free Download Manager\dlselected.htm IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 IE: Google Sidewiki... - c:\arquivos de programas\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_5F1A57F0B9B89E2E.dll/cmsidewiki.html FF - ProfilePath - c:\documents and settings\Edvan\Dados de aplicativos\Mozilla\Firefox\Profiles\06rmnda2.default\ FF - prefs.js: browser.startup.homepage - www.google.com.br FF - component: c:\arquivos de programas\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll FF - plugin: c:\arquivos de programas\Google\Update\1.2.183.13\npGoogleOneClick8.dll FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll ---- FIREFOX POLICIES ---- c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br"); . - - - - ORFÃOS REMOVIDOS - - - - HKLM-Run-GBKH Agent - c:\windows\system32\28463\GBKH.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-01-15 22:41 Windows 5.1.2600 Service Pack 3 NTFS Procurando processos ocultos ... Procurando entradas auto inicializáveis ocultas ... Procurando ficheiros/arquivos ocultos ... Varredura completada com sucesso arquivos/ficheiros ocultos: 0 ************************************************************************** . --------------------- DLLs Carregadas Sob os Processos em Execução --------------------- - - - - - - - > 'explorer.exe'(2004) c:\windows\system32\WININET.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Outros Processos em Execução ------------------------ . c:\windows\RTHDCPL.EXE c:\windows\system32\igfxsrvc.exe c:\arquivos de programas\Java\jre6\bin\jqs.exe c:\arquivos de programas\TeamViewer\Version4\TeamViewer.exe c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe . ************************************************************************** . Tempo para conclusão: 2010-01-15 22:41:52 - Máquina reiniciou ComboFix-quarantined-files.txt 2010-01-16 01:41 Pré-execução: 8 pasta(s) 91.492.360.192 bytes disponíveis Pós execução: 10 pasta(s) 92.196.311.040 bytes disponíveis WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] d:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect - - End Of File - - 96BCBF233F06C011F453C7827741CCBB Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:43:10, on 15/1/2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\RTHDCPL.EXE C:\Arquivos de programas\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Arquivos de programas\Messenger\msmsgs.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe C:\Arquivos de programas\Free Download Manager\fdm.exe C:\Arquivos de programas\Java\jre6\bin\jqs.exe C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe C:\Arquivos de programas\TeamViewer\Version4\TeamViewer.exe C:\WINDOWS\system32\wuauclt.exe C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe C:\WINDOWS\explorer.exe C:\Arquivos de programas\Mozilla Firefox\firefox.exe C:\HiJackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Arquivos de programas\Free Download Manager\iefdm2.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [AVP] "C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" O4 - HKCU\..\Run: [swg] "C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Free Download Manager] "C:\Arquivos de programas\Free Download Manager\fdm.exe" -autorun O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Baixar com o Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dllink.htm O8 - Extra context menu item: Baixar tudo com o Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlall.htm O8 - Extra context menu item: Baixar vídeo com o Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlfvideo.htm O8 - Extra context menu item: Download selecionado pelo Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlselected.htm O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Google Sidewiki... - res://C:\Arquivos de programas\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_5F1A57F0B9B89E2E.dll/cmsidewiki.html O9 - Extra button: Estatísticas de proteção de tráfego da web - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Arquivos de programas\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe -- End of file - 7487 bytes OBS: Que tipo de virus foi esse Garcia que colocaram na minha maquina? Compartilhar este post Link para o post Compartilhar em outros sites
jgarcia 1 Denunciar post Postado Janeiro 20, 2010 Opa Edvan, O serviço ainda não acabou. ^_^ 1. Baixe o DDS e salve-o em seu Desktop. 2. Desabilite seu anti-vírus temporiamente. 3. Dê duplo-clique sobre o ícone alocado em seu Desktop. 4. Quando a janela se abrir solicitando autorização para a execução do arquivo, clique sobre Executar. 5. Uma janela abrir-se-á, conforme abaixo ilustrado: 6. O DDS iniciará a varredura na máquina. 7. Ao fim do processo dois arquivos serão criados: dds.txt e attach.txt. 8. Preciso que você poste o conteúdo do dds.txt em sua próxima resposta. Abraços. Compartilhar este post Link para o post Compartilhar em outros sites
Edvan 30 Denunciar post Postado Janeiro 20, 2010 Pode fechar o tópico Jgarcia, pensava que você estava sabendo, sua amiga está cuidando do meu caso no LD.. Conhece a MariaCristina?? OBS: Inicialmente era para mim ter postado aqui, mais o Fórum estava com alguns problemas internos, daí postei lá no LD, só que eles estava demorando um pouco para responder daí postei aqui, foi erro meu ter postado em dois locais, mais acredito que a MariaCristina cuidando do meu caso é como fosse você, pois ela é Assistente igual a você lá no LD e pelo que vi ela manda super bem, uma pessoa madura e bem experiente na área.. ;) Desculpa aí cara!.. :) Compartilhar este post Link para o post Compartilhar em outros sites
jgarcia 1 Denunciar post Postado Janeiro 21, 2010 Pode fechar o tópico Jgarcia, pensava que você estava sabendo, sua amiga está cuidando do meu caso no LD.. Conhece a MariaCristina?? OBS: Inicialmente era para mim ter postado aqui, mais o Fórum estava com alguns problemas internos, daí postei lá no LD, só que eles estava demorando um pouco para responder daí postei aqui, foi erro meu ter postado em dois locais, mais acredito que a MariaCristina cuidando do meu caso é como fosse você, pois ela é Assistente igual a você lá no LD e pelo que vi ela manda super bem, uma pessoa madura e bem experiente na área.. ;) Desculpa aí cara!.. :) Ok. Sem problema. :D Compartilhar este post Link para o post Compartilhar em outros sites
Edvan 30 Denunciar post Postado Janeiro 22, 2010 beleza então jgarcia , Pode mover meu tópico para casos resolvidos.. :joia: Meu log está limpo. :D Compartilhar este post Link para o post Compartilhar em outros sites
jgarcia 1 Denunciar post Postado Janeiro 23, 2010 PROBLEMA RESOLVIDO! Caso o autor necessite que o tópico seja reaberto basta enviar uma Mensagem Privada para um Moderador com um link para o tópico. Compartilhar este post Link para o post Compartilhar em outros sites
