[Resolvido!] log para analise

[Edvan 30]

Malwarebytes' Anti-Malware 1.44

Versão do banco de dados: 3566

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

 

15/1/2010 00:44:22

mbam-log-2010-01-15 (00-44-22).txt

 

Tipo de Verificação: Completa (C:\|D:\|)

Objetos verificados: 147887

Tempo decorrido: 17 minute(s), 34 second(s)

 

Processos da Memória infectados: 0

Módulos de Memória Infectados: 1

Chaves do Registro infectadas: 0

Valores do Registro infectados: 0

Ítens do Registro infectados: 0

Pastas infectadas: 0

Arquivos infectados: 3

 

Processos da Memória infectados:

(Nenhum ítem malicioso foi detectado)

 

Módulos de Memória Infectados:

C:\WINDOWS\system32\28463\GBKH.007 (PUP.ArdamaxKeyLogger) -> Delete on reboot.

 

Chaves do Registro infectadas:

(Nenhum ítem malicioso foi detectado)

 

Valores do Registro infectados:

(Nenhum ítem malicioso foi detectado)

 

Ítens do Registro infectados:

(Nenhum ítem malicioso foi detectado)

 

Pastas infectadas:

(Nenhum ítem malicioso foi detectado)

 

Arquivos infectados:

C:\WINDOWS\system32\28463\GBKH.007 (PUP.ArdamaxKeyLogger) -> Delete on reboot.

C:\WINDOWS:wins32 (Rootkit.ADS) -> Quarantined and deleted successfully.

C:\WINDOWS\ktd32.atm (Backdoor.ProRat) -> Quarantined and deleted successfully.

 

 

So chego a noite em casa, e quando vou ver meu pc parece uma fazenda de virus..

 

O Kaspersky Internet Security 2009 pegou muitos virus, veja:

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:58:21, on 15/1/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe

C:\Arquivos de programas\TeamViewer\Version4\TeamViewer.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Arquivos de programas\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\system32\28463\GBKH.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexStoreSvr.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\HiJackThis.exe

 

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll

O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Arquivos de programas\Free Download Manager\iefdm2.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [AVP] "C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [GBKH Agent] C:\WINDOWS\system32\28463\GBKH.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] "C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [Free Download Manager] "C:\Arquivos de programas\Free Download Manager\fdm.exe" -autorun

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: "Adicionar ao Bloqueador de banner de anúncio" - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm

O8 - Extra context menu item: Baixar com o Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dllink.htm

O8 - Extra context menu item: Baixar tudo com o Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlall.htm

O8 - Extra context menu item: Baixar vídeo com o Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlfvideo.htm

O8 - Extra context menu item: Download selecionado pelo Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlselected.htm

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Google Sidewiki... - res://C:\Arquivos de programas\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_5F1A57F0B9B89E2E.dll/cmsidewiki.html

O9 - Extra button: Estatísticas de proteção de tráfego da web - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab

O20 - AppInit_DLLs: C:\ARQUIV~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\ARQUIV~1\KASPER~1\KASPER~1\adialhk.dll,C:\ARQUIV~1\KASPER~1\KASPER~1\kloehk.dll

O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Arquivos de programas\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe

O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe

 

--

End of file - 8159 bytes

[jgarcia 1]

Opa Edvan,

 

Baixe o ComboFix em:

ComboFix

 

1) Desabilite o seu anti-vírus temporariamente;

 

2) Dê um duplo-clique no combofix.exe e aguarde (o processo total demora cerca de 10 minutos);

 

3) A janela de “NEGAÇÃO DE GARANTIA DO SOFTWARE” abrir-se-á. Leia atentamente o texto contido nesta janela e clique sobre “SIM” para continuar.

 

PS.: Caso não concorde com os termos clique sobre “NÃO” para sair do software, cabendo lembrar que o processo de desinfecção não será possível sem a continuidade do ComboFix.

 

4) Outra janela irá abrir, caso a sua máquina não possua o CONSOLE DE RECUPERAÇÃO DO WINDOWS. É recomendável executar a instalação do console ante de dar continuidade ao processo, pois tal ação proporcionará a garantia de que o sistema poderá ser recuperado em caso de problemas durante a varredura.

 

Clique sobre “SIM” e aguarde, pois o processo de instalação do console dar-se-á automaticamente através do próprio ComboFix. Ele poderá demorar alguns minutos (dependerá da velocidade de sua conexão), portanto seja paciente.

 

Quando a janela “INSTALANDO O CONSOLE DE RECUPERAÇÃO” aparecer clique em “OK”, depois clique sobre “SIM” para aceitar a licença EULA.

 

Ao término da instalação do console de recuperação abrir-se-á uma janela avisando que “O CONSOLE DE RECUPERAÇÃO FOI INSTALADA COM SUCESSO”.

 

Clique sobre “SIM” para continuar a varredura.

 

5) O ComboFix iniciará o AUTOSCAN (aguarde).

 

ATENÇÃO: Não clique na janela do ComboFix, nem termine o processo abruptamente enquanto a ferramenta estiver sendo executada, pois isto implicará na desconfiguração de seu desktop (ele ficará todo branco).

 

Ao término do processo a máquina será reiniciada para a emissão do relatório.

 

6) Ao reiniciar a máquina o ComboFix irá executar o FIND3M para a criação do relatório final da varredura. O log ficará alocado em C:\ComboFix.txt.

 

7) Reabilite o seu anti-vírus;

 

8) Preciso que você cole o conteúdo do ComboFix.txt em sua próxima resposta.

 

OBS.1: Caso apareça uma mensagem avisando que ESTE NÃO É UM APLICATIVO WIN 32 VÁLIDO baixe o ComboFix novamente, mas salve-o em seu Desktop como KomboFix. Em último caso, tente utilizar o ComboFix em MODO SEGURO.

 

OBS.2: Caso haja um clique sobre a janela do ComboFix em execução, ela irá MAXIMIZAR, sobrepondo-se sobre as demais. Para minimizá-la novamente basta utilizar a combinação ALT + TAB.

 

Abraços.

[Edvan 30]

ComboFix 10-01-15.01 - Edvan 15/01/2010 22:34:35.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.2036.1434 [GMT -3:00]

Executando de: c:\documents and settings\Edvan\Desktop\ComboFix.exe

AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

.

 

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\windows\system32\28463

c:\windows\system32\28463\AKV.exe

c:\windows\system32\28463\GBKH.001

c:\windows\system32\28463\GBKH.002

c:\windows\system32\28463\GBKH.002.tmp

c:\windows\system32\28463\GBKH.005

c:\windows\system32\28463\GBKH.006

c:\windows\system32\28463\GBKH.009

c:\windows\system32\28463\GBKH.009.tmp

c:\windows\system32\28463\GBKH.exe

c:\windows\system32\28463\Jan_15_2010__22_34_11.jpg

 

.

(((((((((((((((( Arquivos/Ficheiros criados de 2009-12-16 to 2010-01-16 ))))))))))))))))))))))))))))

.

 

2010-01-15 17:21 . 2010-01-15 17:21 2560 ----a-w- c:\windows\_MSRSTRT.EXE

2010-01-15 04:10 . 2009-03-27 04:16 12672 ----a-w- c:\windows\system32\drivers\cpuz132_x32.sys

2010-01-15 04:10 . 2010-01-15 04:10 -------- d-----w- c:\arquivos de programas\CPUID

2010-01-15 03:15 . 2010-01-15 03:15 5115824 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2010-01-15 02:08 . 2007-11-18 19:43 19952 ----a-w- c:\documents and settings\Default User\Dados de aplicativos\Kill.exe

2010-01-15 01:56 . 2010-01-15 01:56 -------- d-----w- C:\Downloads

2010-01-14 01:23 . 2010-01-16 01:37 -------- d-----w- c:\documents and settings\Edvan\Dados de aplicativos\Free Download Manager

2010-01-14 01:23 . 2010-01-14 01:23 -------- d-----w- c:\arquivos de programas\Free Download Manager

2010-01-14 01:23 . 2010-01-14 01:23 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\FreeDownloadManager.ORG

2010-01-12 20:51 . 2009-11-21 15:58 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll

2010-01-06 22:17 . 2010-01-06 22:17 -------- d-----w- c:\documents and settings\Edvan\Dados de aplicativos\Ahead

2010-01-06 22:16 . 2010-01-06 22:16 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Ahead

2010-01-06 22:15 . 2010-01-06 22:16 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Ahead

2010-01-06 22:15 . 2010-01-06 22:15 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Nero

2010-01-06 22:15 . 2010-01-06 22:15 -------- d-----w- c:\arquivos de programas\Nero

2010-01-06 14:26 . 2010-01-06 14:26 -------- d-----w- c:\arquivos de programas\Stardock

2010-01-06 14:26 . 2008-04-26 18:14 42672 ------w- c:\windows\system32\wbsys.dll

2010-01-06 14:22 . 2010-01-06 14:22 79488 ----a-w- c:\documents and settings\Edvan\Dados de aplicativos\Sun\Java\jre1.6.0_17\gtapi.dll

2010-01-06 10:45 . 2008-05-09 10:55 180224 -c----w- c:\windows\system32\dllcache\scrobj.dll

2010-01-06 10:45 . 2008-05-09 10:55 172032 -c----w- c:\windows\system32\dllcache\scrrun.dll

2010-01-06 10:45 . 2008-05-09 10:55 90112 -c----w- c:\windows\system32\dllcache\wshext.dll

2010-01-06 10:45 . 2008-05-09 08:45 135168 -c----w- c:\windows\system32\dllcache\cscript.exe

2010-01-06 10:45 . 2008-05-08 11:24 155648 -c----w- c:\windows\system32\dllcache\wscript.exe

2010-01-05 23:13 . 2004-08-04 03:45 221184 ----a-w- c:\windows\system32\wmpns.dll

2010-01-05 22:56 . 2010-01-05 22:56 -------- d-----w- c:\windows\system32\bits

2010-01-05 22:56 . 2010-01-05 22:56 -------- d-----w- c:\windows\l2schemas

2010-01-03 21:18 . 2010-01-03 21:18 411368 ----a-w- c:\windows\system32\deploytk.dll

2010-01-03 21:18 . 2010-01-03 21:18 -------- d-----w- c:\arquivos de programas\Java

2010-01-03 21:17 . 2010-01-03 21:17 152576 ----a-w- c:\documents and settings\Edvan\Dados de aplicativos\Sun\Java\jre1.6.0_16\lzma.dll

2010-01-02 00:06 . 2010-01-02 00:06 -------- d-----w- c:\documents and settings\Edvan\Dados de aplicativos\Malwarebytes

2010-01-02 00:06 . 2010-01-07 19:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-01-02 00:06 . 2010-01-07 19:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-01-02 00:06 . 2010-01-02 00:06 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes

2010-01-02 00:06 . 2010-01-15 03:16 -------- d-----w- c:\arquivos de programas\Malwarebytes' Anti-Malware

2010-01-02 00:05 . 2010-01-02 00:05 -------- d-----w- C:\backups

2010-01-01 22:40 . 2010-01-15 04:01 -------- d---a-w- c:\documents and settings\All Users\Dados de aplicativos\TEMP

2010-01-01 22:40 . 2010-01-15 03:59 -------- d-----w- c:\arquivos de programas\SpywareBlaster

2010-01-01 22:39 . 2010-01-01 22:39 -------- d-----w- c:\documents and settings\Edvan\Dados de aplicativos\Auslogics

2010-01-01 22:39 . 2010-01-01 22:39 -------- d-----w- c:\arquivos de programas\Auslogics

2010-01-01 22:37 . 2010-01-01 22:38 -------- d-----w- c:\arquivos de programas\Marcos Velasco Security

2010-01-01 20:43 . 2010-01-01 20:43 401720 ----a-w- C:\HiJackThis.exe

2010-01-01 18:26 . 2010-01-01 18:26 -------- d-----w- c:\documents and settings\Edvan\Dados de aplicativos\Thinstall

2010-01-01 14:16 . 2010-01-01 14:16 -------- d-----w- c:\arquivos de programas\ESET

2009-12-31 20:53 . 2010-01-15 04:04 -------- d-sh--w- c:\documents and settings\Edvan\IECompatCache

2009-12-31 20:53 . 2010-01-15 04:04 -------- d-sh--w- c:\documents and settings\Edvan\PrivacIE

2009-12-31 20:52 . 2010-01-01 22:44 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache

2009-12-31 20:52 . 2010-01-15 09:54 -------- d-sh--w- c:\documents and settings\Edvan\IETldCache

2009-12-31 20:49 . 2009-10-29 07:42 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll

2009-12-31 20:49 . 2009-10-29 07:42 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll

2009-12-31 20:49 . 2009-10-29 07:42 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll

2009-12-31 20:49 . 2009-10-29 07:42 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll

2009-12-31 20:49 . 2009-10-29 07:42 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll

2009-12-31 20:49 . 2009-10-29 07:42 11069952 -c----w- c:\windows\system32\dllcache\ieframe.dll

2009-12-31 20:49 . 2009-12-31 20:49 -------- d-----w- c:\windows\ie8updates

2009-12-31 20:48 . 2009-10-02 04:44 92160 -c----w- c:\windows\system32\dllcache\iecompat.dll

2009-12-31 20:47 . 2010-01-05 22:56 -------- d-----w- c:\windows\system32\pt-BR

2009-12-31 20:47 . 2009-12-31 20:48 -------- dc-h--w- c:\windows\ie8

2009-12-31 01:31 . 2004-08-04 02:36 701440 ------w- c:\windows\system32\drivers\ati2mtag.sys

2009-12-31 00:23 . 2009-12-31 00:23 -------- d-----w- c:\arquivos de programas\Google

2009-12-31 00:16 . 2009-12-31 00:16 -------- d-----w- c:\documents and settings\LocalService\Dados de aplicativos\TeamViewer

2009-12-30 23:47 . 2010-01-05 22:54 -------- d-----w- c:\windows\ServicePackFiles

2009-12-30 22:44 . 2009-12-30 22:44 -------- d-----w- c:\documents and settings\Edvan\Dados de aplicativos\Media Player Classic

2009-12-30 22:35 . 2009-02-06 10:10 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe

2009-12-30 22:35 . 2009-06-25 08:27 732672 -c----w- c:\windows\system32\dllcache\lsasrv.dll

2009-12-30 22:35 . 2009-03-06 14:20 286208 -c----w- c:\windows\system32\dllcache\pdh.dll

2009-12-30 22:35 . 2009-02-09 11:25 111104 -c----w- c:\windows\system32\dllcache\services.exe

2009-12-30 22:35 . 2009-02-09 10:53 730624 -c----w- c:\windows\system32\dllcache\ntdll.dll

2009-12-30 22:35 . 2009-02-09 10:53 683520 -c----w- c:\windows\system32\dllcache\advapi32.dll

2009-12-30 22:35 . 2009-02-09 10:53 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll

2009-12-30 22:35 . 2009-02-09 10:53 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll

2009-12-30 22:35 . 2009-02-09 10:53 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll

2009-12-30 22:11 . 2008-12-11 10:57 333952 -c----w- c:\windows\system32\dllcache\srv.sys

2009-12-30 21:47 . 2009-12-30 22:18 -------- d-----w- c:\documents and settings\Edvan\Dados de aplicativos\TeamViewer

2009-12-30 21:47 . 2009-12-30 21:47 -------- d-----w- c:\arquivos de programas\TeamViewer

2009-12-30 21:45 . 2009-12-30 21:45 -------- d-----w- c:\documents and settings\Edvan\temp

2009-12-30 21:42 . 2008-10-15 16:36 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll

2009-12-30 21:35 . 2008-04-21 21:15 216064 -c----w- c:\windows\system32\dllcache\wordpad.exe

2009-12-30 21:27 . 2008-04-14 02:20 26624 ----a-w- c:\documents and settings\LocalService\Dados de aplicativos\Microsoft\UPnP Device Host\upnphost\udhisapi.dll

2009-12-30 19:35 . 2009-12-30 19:35 -------- d-----w- c:\arquivos de programas\DsNET Corp

2009-12-30 03:30 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll

2009-12-30 03:22 . 2009-08-04 17:27 2070272 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe

2009-12-30 03:22 . 2009-08-04 17:27 2149376 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe

2009-12-30 03:22 . 2009-08-04 17:27 2028032 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe

2009-12-30 03:14 . 2008-10-24 11:21 455296 -c----w- c:\windows\system32\dllcache\mrxsmb.sys

2009-12-30 03:12 . 2008-04-11 19:05 691712 -c----w- c:\windows\system32\dllcache\inetcomm.dll

2009-12-30 03:10 . 2008-06-14 17:34 272384 -c----w- c:\windows\system32\dllcache\bthport.sys

2009-12-30 03:10 . 2008-06-14 17:34 272384 ------w- c:\windows\system32\drivers\bthport.sys

2009-12-30 03:07 . 2009-12-30 03:07 -------- d-----w- c:\arquivos de programas\Windows Media Connect 2

2009-12-30 03:05 . 2009-12-30 03:06 -------- d-----w- c:\windows\system32\drivers\UMDF

2009-12-30 03:05 . 2009-12-30 03:05 -------- d-----w- c:\windows\system32\LogFiles

2009-12-30 03:05 . 2008-05-08 14:02 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys

2009-12-30 02:50 . 2010-01-13 19:43 -------- d--h--w- c:\windows\$hf_mig$

2009-12-30 02:34 . 2009-12-30 02:34 109072 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\mzvkbd3.dll

2009-12-30 02:34 . 2009-12-30 02:34 59920 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\mzvkbd.dll

2009-12-30 02:34 . 2009-12-30 02:34 208616 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\avp.exe

2009-12-30 02:34 . 2009-12-30 02:34 33808 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\klbg.sys

2009-12-30 02:34 . 2009-12-30 02:34 226832 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\XP\klif.sys

2009-12-29 02:45 . 2009-12-30 02:35 95259 ----a-w- c:\windows\system32\drivers\klick.dat

2009-12-29 02:45 . 2009-12-30 02:35 108059 ----a-w- c:\windows\system32\drivers\klin.dat

2009-12-29 02:44 . 2010-01-16 01:38 360480 --sha-w- c:\windows\system32\drivers\fidbox2.dat

2009-12-29 02:44 . 2010-01-16 01:38 1566240 --sha-w- c:\windows\system32\drivers\fidbox.dat

2009-12-29 02:44 . 2010-01-15 21:54 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab

2009-12-29 02:44 . 2009-12-29 02:44 -------- d-----w- c:\arquivos de programas\Kaspersky Lab

2009-12-29 02:02 . 2003-06-19 03:31 18944 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll

2009-12-29 02:02 . 2003-06-19 03:31 17920 ----a-w- c:\windows\system32\mdimon.dll

2009-12-29 02:02 . 2009-12-29 02:02 -------- d-----w- c:\arquivos de programas\Microsoft.NET

2009-12-29 02:02 . 2009-12-29 02:02 -------- d-----w- c:\windows\SHELLNEW

2009-12-29 01:57 . 2009-12-29 01:57 -------- d-----r- C:\MSOCache

2009-12-29 01:57 . 2009-12-29 01:57 -------- d-----w- c:\arquivos de programas\CCleaner

2009-12-29 01:41 . 2010-01-16 00:23 -------- d-----w- c:\documents and settings\Edvan\Tracing

2009-12-29 01:40 . 2009-12-29 01:40 -------- d-----w- c:\arquivos de programas\Microsoft

2009-12-29 01:39 . 2009-12-29 01:39 -------- d-----w- c:\arquivos de programas\Windows Live SkyDrive

2009-12-29 01:39 . 2009-12-29 01:40 -------- d-----w- c:\arquivos de programas\Windows Live

2009-12-29 01:07 . 2009-12-29 01:07 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Windows Live

2009-12-29 00:55 . 2009-12-29 00:55 0 ----a-w- c:\windows\nsreg.dat

2009-12-29 00:53 . 2009-12-29 00:54 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Adobe

2009-12-29 00:21 . 2010-01-15 12:12 -------- d-sh--w- c:\documents and settings\Edvan\UserData

2009-12-28 23:09 . 2009-04-15 16:32 715520 ----a-w- c:\windows\system32\drivers\rt2870.sys

2009-12-28 23:09 . 2009-04-15 16:31 221184 ----a-w- c:\windows\system32\RaCoInst.dll

2009-12-28 23:09 . 2009-04-15 16:31 13931 ----a-w- c:\windows\system32\RaCoInst.dat

2009-12-28 23:07 . 2008-01-16 01:12 180224 ----a-r- c:\windows\system32\igfxres.dll

2009-12-28 23:04 . 2008-04-14 02:20 4096 ----a-w- c:\windows\system32\ksuser.dll

2009-12-28 23:02 . 2008-01-16 01:12 98944 ----a-r- c:\windows\system32\drivers\Rtenicxp.sys

 

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-01-16 01:38 . 2009-12-29 02:44 3360 --sha-w- c:\windows\system32\drivers\fidbox2.idx

2010-01-16 01:38 . 2009-12-29 02:44 14364 --sha-w- c:\windows\system32\drivers\fidbox.idx

2010-01-14 10:33 . 2001-10-28 15:07 48628 ----a-w- c:\windows\system32\perfc016.dat

2010-01-14 10:33 . 2001-10-28 15:07 344380 ----a-w- c:\windows\system32\perfh016.dat

2010-01-13 01:24 . 2009-12-28 23:02 -------- d--h--w- c:\arquivos de programas\InstallShield Installation Information

2010-01-13 01:24 . 2009-12-28 23:04 -------- d-----w- c:\arquivos de programas\Arquivos comuns\InstallShield

2009-12-30 22:43 . 2009-12-30 22:42 -------- d-----w- c:\arquivos de programas\K-Lite Codec Pack

2009-12-30 09:11 . 2009-12-28 22:53 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat

2009-12-30 02:35 . 2008-01-29 19:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys

2009-12-28 23:04 . 2009-12-28 23:02 -------- d-----w- c:\arquivos de programas\Realtek

2009-12-28 23:04 . 2009-12-28 23:04 315392 ----a-w- c:\windows\HideWin.exe

2009-12-28 23:02 . 2009-12-28 23:02 -------- d-----w- c:\documents and settings\Edvan\Dados de aplicativos\InstallShield

2009-12-28 22:59 . 2009-12-28 22:59 -------- d-----w- c:\arquivos de programas\Intel

2009-12-28 22:58 . 2009-12-28 22:58 -------- d-----w- c:\arquivos de programas\MSXML 4.0

2009-12-28 22:53 . 2009-12-28 22:53 -------- d-----w- c:\arquivos de programas\microsoft frontpage

2009-12-28 22:52 . 2009-12-28 22:52 -------- d-----w- c:\arquivos de programas\Serviços on-line

2009-12-28 22:51 . 2009-12-28 22:51 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Serviços

2009-12-28 22:50 . 2009-12-28 22:50 21844 ----a-w- c:\windows\system32\emptyregdb.dat

2009-12-11 18:00 . 2009-12-30 22:42 85504 ----a-w- c:\windows\system32\ff_vfw.dll

2009-11-21 15:58 . 2004-08-04 03:45 471552 ----a-w- c:\windows\AppPatch\aclayers.dll

2009-10-29 07:42 . 2004-08-04 03:45 916480 ----a-w- c:\windows\system32\wininet.dll

2009-10-21 05:39 . 2004-08-04 03:45 75776 ----a-w- c:\windows\system32\strmfilt.dll

2009-10-21 05:39 . 2004-08-04 03:45 25088 ----a-w- c:\windows\system32\httpapi.dll

2009-10-20 16:20 . 2004-08-04 02:00 265728 ----a-w- c:\windows\system32\drivers\http.sys

.

 

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-12-31 39408]

"MSMSGS"="c:\arquivos de programas\Messenger\msmsgs.exe" [2008-04-14 1695232]

"msnmsgr"="c:\arquivos de programas\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]

"Free Download Manager"="c:\arquivos de programas\Free Download Manager\fdm.exe" [2009-01-31 3399727]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDCPL"="RTHDCPL.EXE" [2008-01-16 16384512]

"SunJavaUpdateSched"="c:\arquivos de programas\Java\jre6\bin\jusched.exe" [2010-01-03 149280]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-16 137752]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-16 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-16 166424]

"Adobe Reader Speed Launcher"="c:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]

"Adobe ARM"="c:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]

"NeroFilterCheck"="c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]

"AVP"="c:\arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-12-30 208616]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

 

[HKLM\~\startupfolder\C:^Documents and Settings^Edvan^Menu Iniciar^Programas^Inicializar^LimeWire On Startup.lnk]

backup=c:\windows\pss\LimeWire On Startup.lnkStartup

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

2007-06-27 21:03 152872 ----a-w- c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Arquivos de programas\\TeamViewer\\Version4\\TeamViewer.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

 

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/1/2008 16:29 33808]

R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [15/1/2010 01:10 12672]

R2 TeamViewer4;TeamViewer 4;c:\arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe [7/10/2009 09:50 185640]

R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/3/2008 17:02 26640]

R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/4/2008 16:06 24592]

S0 tctolw;tctolw;c:\windows\system32\drivers\ntups.sys --> c:\windows\system32\drivers\ntups.sys [?]

S2 gupdate;Google Update Service (gupdate);c:\arquivos de programas\Google\Update\GoogleUpdate.exe [30/12/2009 21:23 135664]

S3 rt2870;D-Link 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [28/12/2009 20:09 715520]

.

Conteúdo da pasta 'Tarefas Agendadas'

 

2010-01-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\arquivos de programas\Google\Update\GoogleUpdate.exe [2009-12-31 00:23]

 

2010-01-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\arquivos de programas\Google\Update\GoogleUpdate.exe [2009-12-31 00:23]

 

2010-01-16 c:\windows\Tasks\User_Feed_Synchronization-{B9C08FFF-A2EE-49BC-A623-5061B828FBFD}.job

- c:\windows\system32\msfeedssync.exe [2009-03-08 06:31]

.

.

------- Scan Suplementar -------

.

uStart Page = hxxp://www.google.com.br/

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Baixar com o Free Download Manager - file://c:\arquivos de programas\Free Download Manager\dllink.htm

IE: Baixar tudo com o Free Download Manager - file://c:\arquivos de programas\Free Download Manager\dlall.htm

IE: Baixar vídeo com o Free Download Manager - file://c:\arquivos de programas\Free Download Manager\dlfvideo.htm

IE: Download selecionado pelo Free Download Manager - file://c:\arquivos de programas\Free Download Manager\dlselected.htm

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\arquivos de programas\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_5F1A57F0B9B89E2E.dll/cmsidewiki.html

FF - ProfilePath - c:\documents and settings\Edvan\Dados de aplicativos\Mozilla\Firefox\Profiles\06rmnda2.default\

FF - prefs.js: browser.startup.homepage - www.google.com.br

FF - component: c:\arquivos de programas\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll

FF - plugin: c:\arquivos de programas\Google\Update\1.2.183.13\npGoogleOneClick8.dll

FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

 

---- FIREFOX POLICIES ----

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

.

- - - - ORFÃOS REMOVIDOS - - - -

 

HKLM-Run-GBKH Agent - c:\windows\system32\28463\GBKH.exe

 

 

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-01-15 22:41

Windows 5.1.2600 Service Pack 3 NTFS

 

Procurando processos ocultos ...

 

Procurando entradas auto inicializáveis ocultas ...

 

Procurando ficheiros/arquivos ocultos ...

 

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

 

**************************************************************************

.

--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

 

- - - - - - - > 'explorer.exe'(2004)

c:\windows\system32\WININET.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Outros Processos em Execução ------------------------

.

c:\windows\RTHDCPL.EXE

c:\windows\system32\igfxsrvc.exe

c:\arquivos de programas\Java\jre6\bin\jqs.exe

c:\arquivos de programas\TeamViewer\Version4\TeamViewer.exe

c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

.

**************************************************************************

.

Tempo para conclusão: 2010-01-15 22:41:52 - Máquina reiniciou

ComboFix-quarantined-files.txt 2010-01-16 01:41

 

Pré-execução: 8 pasta(s) 91.492.360.192 bytes disponíveis

Pós execução: 10 pasta(s) 92.196.311.040 bytes disponíveis

 

WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

d:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

 

- - End Of File - - 96BCBF233F06C011F453C7827741CCBB

 

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:43:10, on 15/1/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Arquivos de programas\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe

C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Arquivos de programas\Free Download Manager\fdm.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe

C:\Arquivos de programas\TeamViewer\Version4\TeamViewer.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

C:\WINDOWS\explorer.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\HiJackThis.exe

 

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll

O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Arquivos de programas\Free Download Manager\iefdm2.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [AVP] "C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"

O4 - HKCU\..\Run: [swg] "C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [Free Download Manager] "C:\Arquivos de programas\Free Download Manager\fdm.exe" -autorun

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: Baixar com o Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dllink.htm

O8 - Extra context menu item: Baixar tudo com o Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlall.htm

O8 - Extra context menu item: Baixar vídeo com o Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlfvideo.htm

O8 - Extra context menu item: Download selecionado pelo Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlselected.htm

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Google Sidewiki... - res://C:\Arquivos de programas\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_5F1A57F0B9B89E2E.dll/cmsidewiki.html

O9 - Extra button: Estatísticas de proteção de tráfego da web - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab

O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Arquivos de programas\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe

O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe

 

--

End of file - 7487 bytes

 

 

 

OBS: Que tipo de virus foi esse Garcia que colocaram na minha maquina?

[jgarcia 1]

Opa Edvan,

 

O serviço ainda não acabou. ^_^

 

1. Baixe o DDS e salve-o em seu Desktop.

 

2. Desabilite seu anti-vírus temporiamente.

 

3. Dê duplo-clique sobre o ícone alocado em seu Desktop.

 

4. Quando a janela se abrir solicitando autorização para a execução do arquivo, clique sobre Executar.

 

5. Uma janela abrir-se-á, conforme abaixo ilustrado:

 

6. O DDS iniciará a varredura na máquina.

 

7. Ao fim do processo dois arquivos serão criados: dds.txt e attach.txt.

 

8. Preciso que você poste o conteúdo do dds.txt em sua próxima resposta.

 

Abraços.

[Edvan 30]

Pode fechar o tópico Jgarcia, pensava que você estava sabendo, sua amiga está cuidando do meu caso no LD..

 

Conhece a MariaCristina??

 

OBS: Inicialmente era para mim ter postado aqui, mais o Fórum estava com alguns problemas internos, daí postei lá no LD, só que eles estava demorando um pouco para responder daí postei aqui, foi erro meu ter postado em dois locais, mais acredito que a MariaCristina cuidando do meu caso é como fosse você, pois ela é Assistente igual a você lá no LD e pelo que vi ela manda super bem, uma pessoa madura e bem experiente na área.. ;)

 

Desculpa aí cara!.. :)

[jgarcia 1]

Pode fechar o tópico Jgarcia, pensava que você estava sabendo, sua amiga está cuidando do meu caso no LD..

 

Conhece a MariaCristina??

 

OBS: Inicialmente era para mim ter postado aqui, mais o Fórum estava com alguns problemas internos, daí postei lá no LD, só que eles estava demorando um pouco para responder daí postei aqui, foi erro meu ter postado em dois locais, mais acredito que a MariaCristina cuidando do meu caso é como fosse você, pois ela é Assistente igual a você lá no LD e pelo que vi ela manda super bem, uma pessoa madura e bem experiente na área.. ;)

 

Desculpa aí cara!.. :)

Ok. Sem problema. :D

[Edvan 30]

beleza então jgarcia , Pode mover meu tópico para casos resolvidos.. :joia:

 

Meu log está limpo. :D

[jgarcia 1]

PROBLEMA RESOLVIDO!

 

Caso o autor necessite que o tópico seja reaberto basta enviar uma Mensagem Privada para um Moderador com um link para o tópico.