[Resolvido!] não consigo instalar antivirus

Manain · Março 17, 2010

Nao consigo instalar antivirus e nem spyboot, tento reiniciar em modo seguro tambem não consigo o PC reinicia sozinho no modo de segurança.

Segue log

Logfile of HijackThis v1.99.1

Scan saved at 22:49:37, on 16/03/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\WIDCOMM\Bluetooth Software\bin\btwdins.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\ARQUIV~1\LAUNCH~1\QtZgAcer.EXE

C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe

C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\InCD.exe

C:\Arquivos de programas\Arquivos comuns\InstallShield\UpdateService\issch.exe

C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\Arquivos de programas\ATI Technologies\ATI.ACE\CLI.EXE

C:\Arquivos de programas\Nokia\Nokia Internet Modem\WellPhone2.exe

C:\folhawin\atualizador\atualizador.exe

C:\folhawin\backup\autobkp\autobkp.exe

C:\Arquivos de programas\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

C:\Arquivos de programas\ATI Technologies\ATI.ACE\cli.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Arquivos de programas\HP\Digital Imaging\Product Assistant\bin\hprblog.exe

C:\DOCUME~1\Usuario\CONFIG~1\Temp\RtkBtMnt.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Arquivos de programas\HJT\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: CompSegIB - {2E3C3651-B19C-4DD9-A979-901EC3E930AF} - C:\Arquivos de programas\Scpad\scpsssh2.dll

O2 - BHO: IE to GetRight Helper - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Arquivos de programas\GetRight\xx2gr.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Arquivos de programas\Free Download Manager\iefdm2.dll

O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Arquivos de programas\Ask.com\GenericAskToolbar.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Arquivos de programas\Ask.com\GenericAskToolbar.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [AzMixerSel] C:\Arquivos de programas\Realtek\InstallShield\AzMixerSel.exe

O4 - HKLM\..\Run: [LManager] C:\ARQUIV~1\LAUNCH~1\QtZgAcer.EXE

O4 - HKLM\..\Run: [ATICCC] "C:\Arquivos de programas\ATI Technologies\ATI.ACE\CLIStart.exe"

O4 - HKLM\..\Run: [iNPROCOMMWireless] C:\Arquivos de programas\Atheros\Wireless\Utility\WlanUtil.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [RemoteControl] "C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [LanguageShortcut] "C:\Arquivos de programas\CyberLink\PowerDVD\Language\Language.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [securDisc] C:\Arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe

O4 - HKLM\..\Run: [inCD] C:\Arquivos de programas\Nero\Nero 7\InCD\InCD.exe

O4 - HKLM\..\Run: [iSUSPM Startup] C:\ARQUIV~1\ARQUIV~1\INSTAL~1\UPDATE~1\isuspm.exe -startup

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Arquivos de programas\Arquivos comuns\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [HP Software Update] C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [ZTE Wireless Terminal] "C:\Arquivos de programas\AIKO 76E\bin\App.exe"

O4 - HKCU\..\Run: [Nokia Internet Modem] "C:\Arquivos de programas\Nokia\Nokia Internet Modem\WellPhone2.exe" /background

O4 - HKCU\..\Run: [cdoosoft] C:\DOCUME~1\Usuario\CONFIG~1\Temp\herss.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Arquivos de programas\Arquivos comuns\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Atualizador Automatico - Folhamatic.lnk = C:\folhawin\atualizador\atualizador.exe

O4 - Global Startup: Auto Backup - Folhamatic.LNK = C:\folhawin\backup\autobkp\autobkp.exe

O4 - Global Startup: BTTray.lnk = ?

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

O8 - Extra context menu item: Baixar com o Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dllink.htm

O8 - Extra context menu item: Baixar tudo com o Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlall.htm

O8 - Extra context menu item: Baixar vídeo com o Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlfvideo.htm

O8 - Extra context menu item: Download selecionado pelo Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlselected.htm

O8 - Extra context menu item: Download with GetRight - C:\Arquivos de programas\GetRight\GRdownload.htm

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Enviar para Dispositivo &Bluetooth... - C:\Arquivos de programas\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O8 - Extra context menu item: Open with GetRight Browser - C:\Arquivos de programas\GetRight\GRbrowse.htm

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Arquivos de programas\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Arquivos de programas\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/MessengerGamesContent/GameContent/pt/uno1/GAME_UNO1.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1255203921203

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{807575EF-C243-4BEE-8569-AC426FF90E70}: NameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\..\{AAD354BA-26B4-4D47-A7B5-75DE4C662074}: NameServer = 200.142.130.202 200.220.227.56

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O21 - SSODL: CompIBBrd - {A3717295-941D-416F-9384-ED1736729F1C} - C:\Arquivos de programas\Scpad\scpLIB.dll

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Arquivos de programas\WIDCOMM\Bluetooth Software\bin\btwdins.exe

O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Arquivos de programas\Java\jre6\bin\jqs.exe" -service -config "C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)

O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

O23 - Service: XAudioService - Conexant Systems, Inc. - C:\WINDOWS\system32\DRIVERS\xaudio.exe

wings · Março 17, 2010

*Baixe o USBFix e salve-o no desktop

*Espete o Pendrive no PC

*Duplo clique em UsbFix

*Tecle P > [ENTER]

*Tecle 1 > [ENTER] e aguarde o término

*Remova o Pendrive

*Cole o relatório criado em C:\UsbFix.txt

Manain · Março 17, 2010

Ok

fiz o procedimento

executei e agora ha um arquivo no c: usbfix.txt

Manain · Março 17, 2010

Aqui esta o log gerado pelo Usbfix

############################## | UsbFix V6.099 |

User : Usuario (Administradores) # ACER

Update on 11/03/2010 by El Desaparecido , C_XX & Chimay8

Start at: 09:17:33 | 17/03/2010

Website : http://pagesperso-orange.fr/NosTools/index.html

Contact : FindyKill.Contact@gmail.com

Mobile AMD Sempron Processor 3500+

Microsoft Windows XP Professional (5.1.2600 32-bit) # Service Pack 3

Internet Explorer 8.0.6001.18702

Windows Firewall Status : Enabled

C:\ -> Disco fixo local # 111,78 Go (49,67 Go free) # NTFS

D:\ -> Disco CD-ROM

E:\ -> Disco removível # 1008,26 Mo (887,93 Mo free) # FAT32

################## | Ficheiros # pastas infeciosos |

C:\DOCUME~1\Usuario\CONFIG~1\Temp\AutoRun.exe

C:\DATA

E:\autorun.inf -> ficheiro chamado : "E:\fk.exe" ( Ausente ! )

E:\autorun.inf

wings · Março 17, 2010

1.

*Espete novamente o Pendrive no PC

*Duplo clique em UsbFix

*Tecle P > [ENTER]

*Tecle 2 > [ENTER] e aguarde o término

*Remova o Pendrive

*Cole o relatório criado em C:\UsbFix.txt

Manain · Março 17, 2010

OBS: é necessário postar em http://chiquitine.chngelog.fr/sample/upload.php o arquivo gerado usbfix_upload_Me_ACER.zip?

Segue o Log criado;

############################## | UsbFix V6.099 |

User : Usuario (Administradores) # ACER

Update on 11/03/2010 by El Desaparecido , C_XX & Chimay8

Start at: 11:05:18 | 17/03/2010

Website : http://pagesperso-orange.fr/NosTools/index.html

Contact : FindyKill.Contact@gmail.com

Mobile AMD Sempron Processor 3500+

Microsoft Windows XP Professional (5.1.2600 32-bit) # Service Pack 3

Internet Explorer 8.0.6001.18702

Windows Firewall Status : Enabled

C:\ -> Disco fixo local # 111,78 Go (49,63 Go free) # NTFS

D:\ -> Disco CD-ROM

################## | Ficheiros # pastas infeciosos |

Supprimido ! C:\DOCUME~1\Usuario\CONFIG~1\Temp\AutoRun.exe

Supprimido ! C:\DATA

Supprimido ! C:\Recycler\S-1-5-21-746137067-823518204-682003330-1003

Supprimido ! C:\Recycler\S-1-5-21-746137067-823518204-682003330-1007

E:\autorun.inf -> ficheiro chamado : "E:\fk.exe" ( Ausente ! )

Supprimido ! E:\autorun.inf

################## | Registro |

Supprimido ! [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "cdoosoft"

Supprimido ! [HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore] "DisableConfig"

Supprimido ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoFolderOptions"

################## | Mountpoints2 |

Supprimido ! HKCU\...\Explorer\MountPoints2\{44ed8af8-b666-11de-85b6-00197e3f60dd}\Shell\AutoRun\Command

Supprimido ! HKCU\...\Explorer\MountPoints2\{8d0cffd0-e8a9-11de-8625-00197e3f60dd}\Shell\AutoRun\Command

################## | Listing |

[08/10/2009 14:44|--a------|0] C:\AUTOEXEC.BAT

[08/10/2009 15:06|-rahs----|223] C:\boot.ini

[14/04/2008 09:00|-rahs----|4952] C:\Bootfont.bin

[08/10/2009 14:44|--a------|0] C:\CONFIG.SYS

[22/01/2009 16:07|---------|466037] C:\desinsta.exe

[08/10/2009 14:44|-rahs----|0] C:\IO.SYS

[08/10/2009 14:44|-rahs----|0] C:\MSDOS.SYS

[14/04/2008 09:00|-rahs----|47564] C:\NTDETECT.COM

[14/04/2008 09:00|-rahs----|251696] C:\ntldr

[?|?|?] C:\pagefile.sys

[11/02/2010 19:55|--a------|15084] C:\PatchLog.txt

[05/03/2010 16:53|--a------|449951] C:\prox.log

[08/10/2009 16:22|--a------|3153920] C:\secsetup.sdb

[17/03/2010 11:13|--a------|2150] C:\UsbFix.txt

[06/03/2010 10:07|--a------|150016] E:\audesp_clientes.xls

[17/02/2010 14:11|--a------|40448] E:\CONTRATO DE LOCA€ÇO Prefeitura.doc

[05/03/2010 15:50|--a------|18432] E:\amec_calculo_custos.xls

[05/03/2010 13:52|--a------|46080] E:\comunicado Amec.doc

[09/03/2010 08:37|--a------|36864] E:\contrato_locacao_IVA.doc

[10/03/2010 08:26|--a------|39936] E:\ComunicadoSDG.doc

[?|?|?] E:\Åeijo.exe

[16/03/2010 07:43|--a------|33122] E:\Rais2008_backup.bkp

[17/03/2010 08:11|--a------|9728] E:\~WRD2275.tmp

[16/03/2010 18:07|--a------|2992752] E:\DMSetup-Serial.exe

[17/03/2010 08:59|--a------|1775837] E:\UsbFix.exe

[24/02/2010 10:59|--a------|134144] E:\PISO DE HONORARIOS ano de 2.01_.doc

[16/03/2010 22:34|--a------|22528] E:\µREA SEGURAN€A.doc

[16/03/2010 23:14|--a------|10949] E:\hijackthis.log

[09/03/2010 16:40|--a------|24576] E:\CARTA_INSS_JAIR FRANCHINI.doc

[17/03/2010 09:21|--a------|1636] E:\UsbFix.txt

[03/03/2010 09:24|--a------|61952] E:\contrato_locacao_nao_residencial.doc

################## | Vaccinação |

# C:\autorun.inf -> Autorun.inf criado por UsbFix (El Desaparecido).

# E:\autorun.inf -> Autorun.inf criado por UsbFix (El Desaparecido).

################## | Upload |

Favor enviar o arquivo : C:\UsbFix_Upload_Me_ACER.zip : http://chiquitine.changelog.fr/Sample/Upload.php

Obrigado pela sua contribuição .

wings · Março 17, 2010

Não...

O arquivo é para você fazer um upload para o autor da ferramenta. Basta clicar no link e enviar o arquivo.

1.

*Duplo clique em UsbFix

*Tecle P > [ENTER]

*Tecle 6 > [ENTER]

2.

*Baixe o AD-Remover e salve-o no desktop

*Duplo clique em AD-R.exe

*Clique em [Clean]...aguarde o término

*Cole o relatório criado em C:\Ad-Report-CLEAN.log e novo log do hijack

Manain · Março 17, 2010

Log do AD-Report Clean

.

======= RAPPORT D'AD-REMOVER 2.0.0.0,A | ONLY XP/VISTA/7 =======

.

Updated by C_XX on 15/03/10 à 17:00

Contact: AdRemover.contact@gmail.com

Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html

.

Started: 15:42:21 le 17/03/2010 | Normal boot | Option: CLEAN

Executed from: C:\Ad-Remover\ADR.exe

Operating systèm: Microsoft® Windows XP™ Service Pack 3

Computer name: ACER | Current user: Usuario (Administrator)

.

============== FIXED ELEMENTS ==============

.

C:\Arquivos de programas\Ask Search Assistant

C:\Arquivos de programas\Ask.com

C:\Arquivos de programas\Mozilla FireFox\Components\AskHPRFF.js

C:\Documents and Settings\Suellen\Configurações locais\Dados de aplicativos\AskToolbar

C:\Documents and Settings\Suellen\Configurações locais\Temp\AskSearch

C:\Documents and Settings\Usuario\Menu Iniciar\Programas\Ask Search Assistant

C:\WINDOWS\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

(!) -- Deleted temporary files.

.

HKCU\Software\AskToolbar

HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}

HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}

HKLM\Software\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}

HKLM\Software\Classes\AppID\GenericAskToolbar.DLL

HKLM\Software\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}

HKLM\Software\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}

HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd

HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd.1

HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF

HKLM\Software\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}

HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\AskSearchAsst.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}

HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ask.com Search Assistant

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{D4027C7F-154A-4066-A1AD-4243D8127440}

HKLM\Software\Microsoft\Internet Explorer\Toolbar|{D4027C7F-154A-4066-A1AD-4243D8127440}

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Arquivos de programas\Ask.com\GenericAskToolbar.dll

.

============== ADDITIONNAL SCAN ==============

.

* Mozilla FireFox Version 3.6 (pt-BR) *

.

C:\Documents and Settings\Usuario\Dados de aplicativos\mozilla\firefox\profiles\izmfp1am.default\prefs.js - browser.download.lastDir: C:\\Documents and Settings\\Usuario\\Meus documentos\\Minhas imagens

C:\Documents and Settings\Usuario\Dados de aplicativos\mozilla\firefox\profiles\izmfp1am.default\prefs.js - browser.startup.homepage: hxxp://www.plusnetwork.com

C:\Documents and Settings\Usuario\Dados de aplicativos\mozilla\firefox\profiles\izmfp1am.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.2

C:\Documents and Settings\Suellen\Dados de aplicativos\Mozilla\Firefox\Profiles\ncg7gp7g.default\prefs.js - browser.download.lastDir: C:\\Documents and Settings\\Suellen\\Meus documentos\\Minhas imagens\\Oun\\Twilight

C:\Documents and Settings\Suellen\Dados de aplicativos\Mozilla\Firefox\Profiles\ncg7gp7g.default\prefs.js - browser.search.defaultenginename: Ask.com

C:\Documents and Settings\Suellen\Dados de aplicativos\Mozilla\Firefox\Profiles\ncg7gp7g.default\prefs.js - browser.search.selectedEngine: Google

C:\Documents and Settings\Suellen\Dados de aplicativos\Mozilla\Firefox\Profiles\ncg7gp7g.default\prefs.js - browser.startup.homepage: hxxp://www.orkut.com.br/Main#Home

C:\Documents and Settings\Suellen\Dados de aplicativos\Mozilla\Firefox\Profiles\ncg7gp7g.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.2

C:\Documents and Settings\Suellen\Dados de aplicativos\Mozilla\Firefox\Profiles\ncg7gp7g.default\prefs.js - keyword.URL: hxxp://supertoolbar.ask.com/redirect?client=ff&src=kw&tb=PTV&o=15184&locale=en_US&q=

.

* Internet Explorer Version 8.0.6001.18702 *

.

[HKCU\Software\Microsoft\Internet Explorer\Main]

.

AutoHide: yes

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

Do404Search: 0x01000000

Enable Browser Extensions: yes

Local Page: C:\WINDOWS\system32\blank.htm

Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896

Show_ToolBar: yes

Start Page: hxxp://fr.msn.com/

Use Custom Search URL: 1

Use Search Asst: no

.

[HKLM\Software\Microsoft\Internet Explorer\Main]

.

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

Delete_Temp_Files_On_Exit: yes

Enable Browser Extensions: yes

Local Page: C:\WINDOWS\system32\blank.htm

Search bar: hxxp://search.msn.com/spbasic.htm

Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

Start Page: hxxp://fr.msn.com/

.

[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]

.

Tabs: res://ieframe.dll/tabswelcome.htm

Blank: res://mshtml.dll/blank.htm

.

========================================

.

C:\DOCUME~1\Usuario\CONFIG~1\Temp: 12 Files, 131 Folders

C:\WINDOWS\temp: 2 Files, 7 Folders

Temporary Internet Files: 3 Files, 13 Folders

.

C:\Ad-Remover\Quarantine: 2 Files

C:\Ad-Remover\Backup: 14 Files

.

C:\Ad-Report-CLEAN[1].txt - 5984 Byte(s)

.

End at:15:50:51, 17/03/2010

.

============== E.O.F - CLEAN[1] ==============

Novo Log hijackthis

Logfile of HijackThis v1.99.1

Scan saved at 15:52:08, on 17/03/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\WIDCOMM\Bluetooth Software\bin\btwdins.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

C:\WINDOWS\RTHDCPL.EXE

C:\ARQUIV~1\LAUNCH~1\QtZgAcer.EXE

C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe

C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\InCD.exe

C:\Arquivos de programas\ATI Technologies\ATI.ACE\CLI.EXE

C:\Arquivos de programas\Arquivos comuns\InstallShield\UpdateService\issch.exe

C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\Arquivos de programas\Nokia\Nokia Internet Modem\WellPhone2.exe

C:\folhawin\atualizador\atualizador.exe

C:\folhawin\backup\autobkp\autobkp.exe

C:\Arquivos de programas\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\Arquivos de programas\ATI Technologies\ATI.ACE\cli.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Arquivos de programas\HP\Digital Imaging\Product Assistant\bin\hprblog.exe

C:\DOCUME~1\Usuario\CONFIG~1\Temp\RtkBtMnt.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\msfeedssync.exe

C:\Arquivos de programas\Java\jre6\bin\javaws.exe

C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jaucheck.exe

C:\Arquivos de programas\Java\jre6\bin\javaw.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Arquivos de programas\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =