Hipino 0 Denunciar post Postado Março 26, 2010 Não importa o que eu faça o Avast continua emitindo alertas do Win32:Alureon-FR infectando a pasta C:\WINDOWS\system32\drivers\atapi.sys li sobre o combofix e nas recomendaçoes a procura por auxilio por pessoas treinadas era enfatica. Passei o HiJAckThis e o log esta aseguir: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:22:26, on 26/3/2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\RTHDCPL.EXE C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe C:\Arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe C:\Arquivos de programas\Nero\Nero 7\InCD\InCD.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\svchost.exe C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\wdfmgr.exe C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\alg.exe C:\Arquivos de programas\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\HiJackThis\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://br.ask.com?o=15796&l=dis R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Arquivos de programas\Ask.com\GenericAskToolbar.dll R3 - URLSearchHook: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Arquivos de programas\BS_Player\tbBS_1.dll (file missing) O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Arquivos de programas\BitComet\tools\BitCometBHO_1.4.1.10.dll O2 - BHO: G-Buster Browser Defense Banco Real - {C41A1C0E-EA6C-11D4-B1B8-444553540007} - C:\ARQUIV~1\GbPlugin\gbiehAbn.dll O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Arquivos de programas\Ask.com\GenericAskToolbar.dll O2 - BHO: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Arquivos de programas\BS_Player\tbBS_1.dll (file missing) O3 - Toolbar: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Arquivos de programas\BS_Player\tbBS_1.dll (file missing) O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Arquivos de programas\Ask.com\GenericAskToolbar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [securDisc] C:\Arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe O4 - HKLM\..\Run: [inCD] C:\Arquivos de programas\Nero\Nero 7\InCD\InCD.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [star3] C:\WINDOWS\system32\Xred1.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [star4] C:\WINDOWS\system32\Zred2.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [star6] C:\WINDOWS\system32\MscheldB.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [star7] C:\WINDOWS\system32\Mscheldncx.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [star8] C:\WINDOWS\system32\svscheld.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &B&aixar &com o BitComet - res://C:\Arquivos de programas\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &B&aixar todos os vídeos com o BitComet - res://C:\Arquivos de programas\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &B&aixar tudo usando o BitComet - res://C:\Arquivos de programas\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Arquivos de programas\BitComet\tools\BitCometBHO_1.4.1.10.dll/206 (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399007} (GbPluginObj Class) - https://wwws.realsecureweb.com.br/mpr/plugin/Cab/GbPluginABN.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{298207B2-C2EA-4E2C-9BBD-1F24489FE553}: NameServer = 200.204.0.10 200.204.0.138 O17 - HKLM\System\CS3\Services\Tcpip\..\{298207B2-C2EA-4E2C-9BBD-1F24489FE553}: NameServer = 200.204.0.10 200.204.0.138 O17 - HKLM\System\CS4\Services\Tcpip\..\{298207B2-C2EA-4E2C-9BBD-1F24489FE553}: NameServer = 200.204.0.10 200.204.0.138 O17 - HKLM\System\CS9\Services\Tcpip\..\{298207B2-C2EA-4E2C-9BBD-1F24489FE553}: NameServer = 200.204.0.10 200.204.0.138 O20 - Winlogon Notify: GbPluginAbn - C:\ARQUIV~1\GbPlugin\gbiehAbn.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Gbp Service (GbpSv) - Unknown owner - C:\ARQUIV~1\GbPlugin\GbpSv.exe (file missing) O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: Nero Registry InCD Service (NeroRegInCDSrv) - Unknown owner - C:\Arquivos de programas\Nero\Nero 7\InCD\NBHRegInCDSrv.exe (file missing) O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 7892 bytes Agradeço desde ja. E na espera de 5 dias referida nas regras. abraço Compartilhar este post Link para o post Compartilhar em outros sites
MGuitar 11 Denunciar post Postado Março 27, 2010 li sobre o combofix e nas recomendaçoes a procura por auxilio por pessoas treinadas era enfatica. Já que leu sobre o ComboFix, execute-o e poste o log. Compartilhar este post Link para o post Compartilhar em outros sites
Hipino 0 Denunciar post Postado Março 27, 2010 Foi Duro conseguir executar o CF até ele gerar o log Meu computador reiniciou uma vez na etapa 6, depois apareceu uma Tela azul e eu tive que reinicialo manualemnte. Depois de Execultado 4 vezes aqui esta o tão esperado log. Muito Obrigado pela ajuda Aseguir seus hierógrifos ComboFix 10-03-27.02 - Guilherme Affonso 27/03/2010 20:25:17.2.4 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.3263.2699 [GMT -3:00] Executando de: C:\Documents and Settings\Guilherme Affonso\Desktop\ComboFix.exe AV: avast! antivirus 4.8.1368 [VPS 100327-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} . ADS - drivers: deleted 208 bytes in 1 streams. ((((((((((((((((((((((((((((((((((((( Outras Exclusões ))))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Execuções precedente ------- . C:\DOCUME~1\GUILHE~1\CONFIG~1\Temp\tmp2.tmp C:\Documents and Settings\Guilherme Affonso\siuon.exe C:\Documents and Settings\Guilherme Affonso\zoazo.exe C:\WINDOWS\control.ctr C:\WINDOWS\key2010 C:\WINDOWS\zUptPitu.dt . ((((((((((((((((((((((((((((((((((((((( Drivers/Serviços ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_K10 -------\Legacy_SSHNAS (((((((((((((((( Arquivos/Ficheiros criados de 2010-02-27 to 2010-03-27 )))))))))))))))))))))))))))) . 2010-03-26 18:22:01 . 2010-03-26 18:27:10 -------- d-----w- C:\HiJackThis 2010-03-26 18:04:29 . 2008-04-13 19:40:30 96512 ----a-w- C:\WINDOWS\system32\drivers\atapi.sys 2010-03-26 18:04:25 . 2010-03-26 18:49:48 96512 -c--a-w- C:\WINDOWS\system32\dllcache\atapi.sys 2010-03-18 18:10:38 . 2010-03-18 18:10:40 -------- d-----w- C:\Arquivos de programas\Ares 2010-03-18 14:02:59 . 2010-03-18 14:03:11 2742272 ----a-w- C:\WINDOWS\winl.exe 2010-03-10 18:16:30 . 2010-03-10 18:16:30 -------- d-----w- C:\Documents and Settings\All Users\Dados de aplicativos\Soulseek 2010-03-10 14:49:50 . 2009-10-23 15:28:37 3558912 -c----w- C:\WINDOWS\system32\dllcache\moviemk.exe . ((((((((((((((((((((((((((((((((((((( Relatório Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-03-27 23:25:16 . 2001-10-28 15:07:18 49804 ----a-w- C:\WINDOWS\system32\perfc016.dat 2010-03-27 23:25:16 . 2001-10-28 15:07:18 347648 ----a-w- C:\WINDOWS\system32\perfh016.dat 2010-03-20 17:53:31 . 2009-11-08 22:52:20 -------- d-----w- C:\Arquivos de programas\BitComet 2010-03-20 16:36:51 . 2010-03-20 07:50:40 7552 ----a-w- C:\WINDOWS\system32\drivers\k10.sys.off 2010-03-20 16:36:44 . 2009-11-20 01:41:25 -------- d-----w- C:\Arquivos de programas\GbPlugin 2010-03-18 16:12:33 . 2009-11-08 22:51:49 -------- d-----w- C:\Documents and Settings\Guilherme Affonso\Dados de aplicativos\uTorrent 2010-02-20 03:44:54 . 2010-02-20 03:44:46 -------- d-----w- C:\Arquivos de programas\Ask.com 2010-02-20 03:44:32 . 2009-11-08 22:51:55 -------- d-----w- C:\Arquivos de programas\uTorrent 2010-02-20 03:44:31 . 2010-02-20 03:44:31 1036288 ----a-w- C:\Documents and Settings\Guilherme Affonso\Dados de aplicativos\Mozilla\Firefox\Profiles\zjf8xx8l.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll 2010-02-16 02:27:28 . 2009-11-09 10:34:38 -------- d-----w- C:\Arquivos de programas\Arquivos comuns\Adobe 2009-12-31 20:48:44 . 2009-12-31 20:48:04 536844 ----a-w- C:\output.dat 2009-12-31 16:50:03 . 2004-08-04 02:14:46 353792 ----a-w- C:\WINDOWS\system32\drivers\srv.sys . (((((((((((((((((((((((((( Pontos de Carregamento do Registro ))))))))))))))))))))))))))))))))))))))) . . *Nota* entradas vazias e legítimas por defeito não são mostradas. REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{00000000-6E41-4FD3-8538-502F5495E5FC}"= "C:\Arquivos de programas\Ask.com\GenericAskToolbar.dll" [2010-02-04 18:50:26 1197448] [HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2010-02-04 18:50:26 1197448 ----a-w- C:\Arquivos de programas\Ask.com\GenericAskToolbar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "C:\Arquivos de programas\Ask.com\GenericAskToolbar.dll" [2010-02-04 18:50:26 1197448] [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "C:\Arquivos de programas\Ask.com\GenericAskToolbar.dll" [2010-02-04 18:50:26 1197448] [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-24 23:02:00 8491008] "nwiz"="nwiz.exe" [2007-10-24 23:02:00 1626112] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-24 23:02:00 81920] "RTHDCPL"="RTHDCPL.EXE" [2008-03-26 08:14:12 16859136] "avast!"="C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 23:51:40 81000] "NeroFilterCheck"="C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe" [2008-02-27 15:03:24 570664] "SecurDisc"="C:\Arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe" [2008-02-18 16:36:24 1629480] "InCD"="C:\Arquivos de programas\Nero\Nero 7\InCD\InCD.exe" [2008-02-18 16:36:04 1057064] "Adobe Reader Speed Launcher"="C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 03:57:28 35760] "Adobe ARM"="C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 17:57:56 948672] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 02:20:54 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginAbn] 2009-10-22 16:01:04 310824 ----a-w- C:\ARQUIV~1\GbPlugin\gbiehAbn.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Arquivos de programas\\uTorrent\\uTorrent.exe"= "C:\\Arquivos de programas\\Messenger\\msmsgs.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Arquivos de programas\\BitComet\\BitComet.exe"= "C:\\Arquivos de programas\\Ares\\Ares.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "18940:TCP"= 18940:TCP:BitComet 18940 TCP "18940:UDP"= 18940:UDP:BitComet 18940 UDP R0 GbpKm;Gbp KernelMode;C:\WINDOWS\system32\drivers\GbpKm.sys [19/11/2009 22:41:26 31080] R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [8/11/2009 19:42:15 114768] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\drivers\aswFsBlk.sys [8/11/2009 19:42:15 20560] S2 GbpSv;Gbp Service;C:\ARQUIV~1\GbPlugin\GbpSv.exe --> C:\ARQUIV~1\GbPlugin\GbpSv.exe [?] S2 NeroRegInCDSrv;Nero Registry InCD Service;C:\Arquivos de programas\Nero\Nero 7\InCD\NBHRegInCDSrv.exe --> C:\Arquivos de programas\Nero\Nero 7\InCD\NBHRegInCDSrv.exe [?] S3 SetupNTGLM7X;SetupNTGLM7X;\??\D:\NTGLM7X.sys --> D:\NTGLM7X.sys [?] . Conteúdo da pasta 'Tarefas Agendadas' 2010-03-27 C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job - C:\Arquivos de programas\Ask.com\UpdateTask.exe [2010-02-04 18:50:28 . 2010-02-04 18:50:28] . . ------- Scan Suplementar ------- . uStart Page = hxxp://br.ask.com?o=15796&l=dis IE: &B&aixar &com o BitComet - C:\Arquivos de programas\BitComet\BitComet.exe/AddLink.htm IE: &B&aixar todos os vídeos com o BitComet - C:\Arquivos de programas\BitComet\BitComet.exe/AddVideo.htm IE: &B&aixar tudo usando o BitComet - C:\Arquivos de programas\BitComet\BitComet.exe/AddAllLink.htm IE: E&xportar para o Microsoft Excel - C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 TCP: {298207B2-C2EA-4E2C-9BBD-1F24489FE553} = 200.204.0.10 200.204.0.138 FF - ProfilePath - C:\Documents and Settings\Guilherme Affonso\Dados de aplicativos\Mozilla\Firefox\Profiles\zjf8xx8l.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1750559&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q= FF - component: C:\Documents and Settings\Guilherme Affonso\Dados de aplicativos\Mozilla\Firefox\Profiles\zjf8xx8l.default\extensions\{87F8774F-B485-47E2-A755-A40A8A5E8874}\components\GbMzhAbn.dll FF - component: C:\Documents and Settings\Guilherme Affonso\Dados de aplicativos\Mozilla\Firefox\Profiles\zjf8xx8l.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll FF - plugin: C:\Arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: C:\Arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll ---- FIREFOX POLICIES ---- C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false); C:\Arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true); C:\Arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); C:\Arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); C:\Arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br"); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); . - - - - ORFÃOS REMOVIDOS - - - - URLSearchHooks-{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Arquivos de programas\BS_Player\tbBS_1.dll BHO-{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Arquivos de programas\BS_Player\tbBS_1.dll Toolbar-{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Arquivos de programas\BS_Player\tbBS_1.dll WebBrowser-{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5} - C:\Arquivos de programas\BS_Player\tbBS_1.dll HKU-Default-Run-star1 - C:\WINDOWS\system32\Winrun.exe HKU-Default-Run-star2 - C:\WINDOWS\system32\ischot.exe HKU-Default-Run-star3 - C:\WINDOWS\system32\Xred1.exe HKU-Default-Run-star4 - C:\WINDOWS\system32\Zred2.exe HKU-Default-Run-star6 - C:\WINDOWS\system32\MscheldB.exe HKU-Default-Run-star7 - C:\WINDOWS\system32\Mscheldncx.exe HKU-Default-Run-star8 - C:\WINDOWS\system32\svscheld.exe AddRemove-BS_Player Toolbar - C:\ARQUIV~1\BS_PLA~1\UNWISE.EXE AddRemove-HijackThis - C:\Documents and Settings\Guilherme Affonso\Meus documentos\Downloads\HijackThis.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-03-27 20:26:56 Windows 5.1.2600 Service Pack 3 NTFS Procurando processos ocultos ... Procurando entradas auto inicializáveis ocultas ... Procurando ficheiros/arquivos ocultos ... Varredura completada com sucesso arquivos/ficheiros ocultos: 0 ************************************************************************** . --------------------- DLLs Carregadas Sob os Processos em Execução --------------------- - - - - - - - > 'winlogon.exe'(700) C:\ARQUIV~1\GbPlugin\gbiehAbn.dll . Tempo para conclusão: 2010-03-27 20:27:47 ComboFix-quarantined-files.txt 2010-03-27 23:27:45 Pré-execução: 9 pasta(s) 434.250.915.840 bytes disponíveis Pós execução: 10 pasta(s) 434.209.894.400 bytes disponíveis Current=10 Default=10 Failed=9 LastKnownGood=11 Sets=1,2,3,4,5,6,7,8,9,10,11 - - End Of File - - F2563CEC325F833DE2F5EBBB01BADB92 Compartilhar este post Link para o post Compartilhar em outros sites
MGuitar 11 Denunciar post Postado Março 28, 2010 Acesse o site '>http://www.virustotal.com/pt/"]VirusTotal. Copie este caminho em destaque abaixo e cole ao lado do botão . Clique em Enviar Arquivo e aguarde a análise. C:\WINDOWS\system32\drivers\atapi.sys Ao término, clique em "Mostrar último relatório". Copie a URL da página com o resultado e poste aqui. Selecione e copie este texto abaixo (a partir de File). Cole no Bloco de Notas e salve-o no desktop como CFScript.txt File::C:\WINDOWS\winl.exe C:\WINDOWS\system32\drivers\k10.sys.off C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job Folder:: C:\Arquivos de programas\Ask.com Registry:: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{00000000-6E41-4FD3-8538-502F5495E5FC}"=- [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"=- [-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{D4027C7F-154A-4066-A1AD-4243D8127440}"=- [-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] DDS:: uStart Page = hxxp://br.ask.com?o=15796&l=dis Registry-clean:: Arraste o CFScript para o ComboFix como na imagem aqui abaixo e aguarde a execução automática da ferramenta: ● Se for solicitado à você, pressione Enter para iniciar o processo de remoção; ● Não use o mouse nem o teclado quando o ComboFix estiver rodando; ● Quando terminar, será gerado um novo log que estará em C:\ComboFix.txt; ● Talvez seu computador seja reiniciado automaticamente. Caso não ocorra, reinicie-o manualmente. Na sua próxima resposta, cole o ComboFix.txt, o resultado do VirusTotal e um novo log do HijackThis. Compartilhar este post Link para o post Compartilhar em outros sites
Hipino 0 Denunciar post Postado Março 30, 2010 Tudo feito da menira exata como pediu, estou mandando os resultados. ComboFix: ComboFix 10-03-27.02 - Guilherme Affonso 29/03/2010 21:39:32.4.4 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.3263.2807 [GMT -3:00] Executando de: c:\documents and settings\Guilherme Affonso\Desktop\ComboFix.exe Comandos utilizados :: c:\documents and settings\Guilherme Affonso\Desktop\CFScript.txt AV: avast! antivirus 4.8.1368 [VPS 100329-2] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} FILE :: "c:\windows\system32\drivers\k10.sys.off" "c:\windows\Tasks\Scheduled Update for Ask Toolbar.job" "c:\windows\winl.exe" . ADS - drivers: deleted 208 bytes in 1 streams. ((((((((((((((((((((((((((((((((((((( Outras Exclusões ))))))))))))))))))))))))))))))))))))))))))))))))))) . c:\arquivos de programas\Ask.com c:\arquivos de programas\Ask.com\cobrand.ico c:\arquivos de programas\Ask.com\config.xml c:\arquivos de programas\Ask.com\favicon.ico c:\arquivos de programas\Ask.com\GenericAskToolbar.dll c:\arquivos de programas\Ask.com\mupcfg.xml c:\arquivos de programas\Ask.com\SaUpdate.exe c:\arquivos de programas\Ask.com\UpdateTask.exe c:\windows\system32\drivers\k10.sys.off c:\windows\Tasks\Scheduled Update for Ask Toolbar.job c:\windows\winl.exe . (((((((((((((((( Arquivos/Ficheiros criados de 2010-02-28 to 2010-03-30 )))))))))))))))))))))))))))) . 2010-03-26 18:22 . 2010-03-26 18:27 -------- d-----w- C:\HiJackThis 2010-03-26 18:04 . 2008-04-13 19:40 96512 ------w- c:\windows\system32\drivers\atapi.sys 2010-03-26 18:04 . 2010-03-26 18:49 96512 -c--a-w- c:\windows\system32\dllcache\atapi.sys 2010-03-18 18:10 . 2010-03-18 18:10 -------- d-----w- c:\arquivos de programas\Ares 2010-03-10 18:16 . 2010-03-10 18:16 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Soulseek 2010-03-10 14:49 . 2009-10-23 15:28 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe . ((((((((((((((((((((((((((((((((((((( Relatório Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-03-30 00:40 . 2001-10-28 15:07 49804 ----a-w- c:\windows\system32\perfc016.dat 2010-03-30 00:40 . 2001-10-28 15:07 347648 ----a-w- c:\windows\system32\perfh016.dat 2010-03-20 17:53 . 2009-11-08 22:52 -------- d-----w- c:\arquivos de programas\BitComet 2010-03-20 16:36 . 2009-11-20 01:41 -------- d-----w- c:\arquivos de programas\GbPlugin 2010-03-18 16:12 . 2009-11-08 22:51 -------- d-----w- c:\documents and settings\Guilherme Affonso\Dados de aplicativos\uTorrent 2010-02-20 03:44 . 2009-11-08 22:51 -------- d-----w- c:\arquivos de programas\uTorrent 2010-02-20 03:44 . 2010-02-20 03:44 1036288 ----a-w- c:\documents and settings\Guilherme Affonso\Dados de aplicativos\Mozilla\Firefox\Profiles\zjf8xx8l.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll 2010-02-16 02:27 . 2009-11-09 10:34 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Adobe 2009-12-31 20:48 . 2009-12-31 20:48 536844 ----a-w- C:\output.dat 2009-12-31 16:50 . 2004-08-04 02:14 353792 ----a-w- c:\windows\system32\drivers\srv.sys . ((((((((((((((((((((((((((((( SnapShot@2010-03-27_23.26.57 ))))))))))))))))))))))))))))))))))))))))) . + 2010-03-30 00:35 . 2010-03-30 00:35 16384 c:\windows\Temp\Perflib_Perfdata_560.dat + 2001-10-28 15:07 . 2010-03-30 00:40 40972 c:\windows\system32\perfc009.dat - 2001-10-28 15:07 . 2010-03-27 23:25 40972 c:\windows\system32\perfc009.dat + 2001-10-28 15:07 . 2010-03-30 00:40 314644 c:\windows\system32\perfh009.dat - 2001-10-28 15:07 . 2010-03-27 23:25 314644 c:\windows\system32\perfh009.dat . (((((((((((((((((((((((((( Pontos de Carregamento do Registro ))))))))))))))))))))))))))))))))))))))) . . *Nota* entradas vazias e legítimas por defeito não são mostradas. REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}"= "c:\arquivos de programas\BS_Player\tbBS_1.dll" [bU] [HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}] c:\arquivos de programas\BS_Player\tbBS_1.dll [bU] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}"= "c:\arquivos de programas\BS_Player\tbBS_1.dll" [bU] [HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5}"= "c:\arquivos de programas\BS_Player\tbBS_1.dll" [bU] [HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-24 8491008] "nwiz"="nwiz.exe" [2007-10-24 1626112] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-10-24 81920] "RTHDCPL"="RTHDCPL.EXE" [2008-03-26 16859136] "avast!"="c:\arquiv~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000] "NeroFilterCheck"="c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe" [2008-02-27 570664] "SecurDisc"="c:\arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe" [2008-02-18 1629480] "InCD"="c:\arquivos de programas\Nero\Nero 7\InCD\InCD.exe" [2008-02-18 1057064] "Adobe Reader Speed Launcher"="c:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760] "Adobe ARM"="c:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] "star1"="c:\windows\system32\Winrun.exe" [bU] "star2"="c:\windows\system32\ischot.exe" [bU] "star3"="c:\windows\system32\Xred1.exe" [bU] "star4"="c:\windows\system32\Zred2.exe" [bU] "star6"="c:\windows\system32\MscheldB.exe" [bU] "star7"="c:\windows\system32\Mscheldncx.exe" [bU] "star8"="c:\windows\system32\svscheld.exe" [bU] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginAbn] 2009-10-22 16:01 310824 ----a-w- c:\arquiv~1\GbPlugin\gbiehAbn.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Arquivos de programas\\uTorrent\\uTorrent.exe"= "c:\\Arquivos de programas\\Messenger\\msmsgs.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Arquivos de programas\\BitComet\\BitComet.exe"= "c:\\Arquivos de programas\\Ares\\Ares.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "18940:TCP"= 18940:TCP:BitComet 18940 TCP "18940:UDP"= 18940:UDP:BitComet 18940 UDP R0 GbpKm;Gbp KernelMode;c:\windows\system32\drivers\GbpKm.sys [19/11/2009 22:41 31080] R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [8/11/2009 19:42 114768] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [8/11/2009 19:42 20560] S2 GbpSv;Gbp Service;c:\arquiv~1\GbPlugin\GbpSv.exe --> c:\arquiv~1\GbPlugin\GbpSv.exe [?] S2 NeroRegInCDSrv;Nero Registry InCD Service;c:\arquivos de programas\Nero\Nero 7\InCD\NBHRegInCDSrv.exe --> c:\arquivos de programas\Nero\Nero 7\InCD\NBHRegInCDSrv.exe [?] S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys --> d:\NTGLM7X.sys [?] . . ------- Scan Suplementar ------- . IE: &B&aixar &com o BitComet - c:\arquivos de programas\BitComet\BitComet.exe/AddLink.htm IE: &B&aixar todos os vídeos com o BitComet - c:\arquivos de programas\BitComet\BitComet.exe/AddVideo.htm IE: &B&aixar tudo usando o BitComet - c:\arquivos de programas\BitComet\BitComet.exe/AddAllLink.htm IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Guilherme Affonso\Dados de aplicativos\Mozilla\Firefox\Profiles\zjf8xx8l.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1750559&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q= FF - component: c:\documents and settings\Guilherme Affonso\Dados de aplicativos\Mozilla\Firefox\Profiles\zjf8xx8l.default\extensions\{87F8774F-B485-47E2-A755-A40A8A5E8874}\components\GbMzhAbn.dll FF - component: c:\documents and settings\Guilherme Affonso\Dados de aplicativos\Mozilla\Firefox\Profiles\zjf8xx8l.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll ---- FIREFOX POLICIES ---- c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false); c:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true); c:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br"); c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-03-29 21:41 Windows 5.1.2600 Service Pack 3 NTFS Procurando processos ocultos ... Procurando entradas auto inicializáveis ocultas ... Procurando ficheiros/arquivos ocultos ... Varredura completada com sucesso arquivos/ficheiros ocultos: 0 ************************************************************************** . --------------------- DLLs Carregadas Sob os Processos em Execução --------------------- - - - - - - - > 'winlogon.exe'(700) c:\arquiv~1\GbPlugin\gbiehAbn.dll . Tempo para conclusão: 2010-03-29 21:42:15 ComboFix-quarantined-files.txt 2010-03-30 00:42 Pré-execução: 9 pasta(s) 434.247.692.288 bytes disponíveis Pós execução: 10 pasta(s) 434.228.015.104 bytes disponíveis Current=10 Default=10 Failed=9 LastKnownGood=11 Sets=1,2,3,4,5,6,7,8,9,10,11 - - End Of File - - 1DDF96B6E29745F92D8DE4D51279FDEE Virus Total: http://www.virustotal.com/pt/analisis/b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9-1269894236 HiJackThis: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:46:47, on 29/3/2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\spoolsv.exe C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe C:\Arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe C:\Arquivos de programas\Nero\Nero 7\InCD\InCD.exe C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe C:\WINDOWS\system32\svchost.exe C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\wuauclt.exe C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\alg.exe C:\HiJackThis\HiJackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R3 - URLSearchHook: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Arquivos de programas\BS_Player\tbBS_1.dll (file missing) O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Arquivos de programas\BitComet\tools\BitCometBHO_1.4.1.10.dll O2 - BHO: G-Buster Browser Defense Banco Real - {C41A1C0E-EA6C-11D4-B1B8-444553540007} - C:\ARQUIV~1\GbPlugin\gbiehAbn.dll O2 - BHO: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Arquivos de programas\BS_Player\tbBS_1.dll (file missing) O3 - Toolbar: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Arquivos de programas\BS_Player\tbBS_1.dll (file missing) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [securDisc] C:\Arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe O4 - HKLM\..\Run: [inCD] C:\Arquivos de programas\Nero\Nero 7\InCD\InCD.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [star1] C:\WINDOWS\system32\Winrun.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [star2] C:\WINDOWS\system32\ischot.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [star3] C:\WINDOWS\system32\Xred1.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [star4] C:\WINDOWS\system32\Zred2.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [star6] C:\WINDOWS\system32\MscheldB.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [star7] C:\WINDOWS\system32\Mscheldncx.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [star8] C:\WINDOWS\system32\svscheld.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &B&aixar &com o BitComet - res://C:\Arquivos de programas\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &B&aixar todos os vídeos com o BitComet - res://C:\Arquivos de programas\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &B&aixar tudo usando o BitComet - res://C:\Arquivos de programas\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Arquivos de programas\BitComet\tools\BitCometBHO_1.4.1.10.dll/206 (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399007} (GbPluginObj Class) - https://wwws.realsecureweb.com.br/mpr/plugin/Cab/GbPluginABN.cab O17 - HKLM\System\CS3\Services\Tcpip\..\{298207B2-C2EA-4E2C-9BBD-1F24489FE553}: NameServer = 200.204.0.10 200.204.0.138 O17 - HKLM\System\CS4\Services\Tcpip\..\{298207B2-C2EA-4E2C-9BBD-1F24489FE553}: NameServer = 200.204.0.10 200.204.0.138 O20 - Winlogon Notify: GbPluginAbn - C:\ARQUIV~1\GbPlugin\gbiehAbn.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Gbp Service (GbpSv) - Unknown owner - C:\ARQUIV~1\GbPlugin\GbpSv.exe (file missing) O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: Nero Registry InCD Service (NeroRegInCDSrv) - Unknown owner - C:\Arquivos de programas\Nero\Nero 7\InCD\NBHRegInCDSrv.exe (file missing) O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 7379 bytes Compartilhar este post Link para o post Compartilhar em outros sites
MGuitar 11 Denunciar post Postado Abril 1, 2010 Selecione e copie este texto abaixo (a partir de Registry). Cole no Bloco de Notas e salve-o no desktop como CFScript.txt Registry::[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "star1"=- "star2"=- "star3"=- "star4"=- "star6"=- "star7"=- "star8"=- File:: c:\windows\system32\Winrun.exe c:\windows\system32\ischot.exe c:\windows\system32\Xred1.exe c:\windows\system32\Zred2.exe c:\windows\system32\MscheldB.exe c:\windows\system32\Mscheldncx.exe c:\windows\system32\svscheld.exe Arraste o CFScript para o ComboFix como na imagem aqui abaixo e aguarde a execução automática da ferramenta: ● Se for solicitado à você, pressione Enter para iniciar o processo de remoção; ● Não use o mouse nem o teclado quando o ComboFix estiver rodando; ● Quando terminar, será gerado um novo log que estará em C:\ComboFix.txt; ● Talvez seu computador seja reiniciado automaticamente. Caso não ocorra, reinicie-o manualmente. Na sua próxima resposta, cole o ComboFix.txt e um novo log do HijackThis. Compartilhar este post Link para o post Compartilhar em outros sites
Hipino 0 Denunciar post Postado Abril 1, 2010 Log do combo fix segue: ComboFix 10-03-27.02 - Guilherme Affonso 01/04/2010 15:40:42.5.4 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.3263.2779 [GMT -3:00] Executando de: C:\Documents and Settings\Guilherme Affonso\Desktop\ComboFix.exe Comandos utilizados :: C:\Documents and Settings\Guilherme Affonso\Desktop\CFScript.txt AV: avast! antivirus 4.8.1368 [VPS 100401-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} FILE :: "c:\windows\system32\ischot.exe" "c:\windows\system32\MscheldB.exe" "c:\windows\system32\Mscheldncx.exe" "c:\windows\system32\svscheld.exe" "c:\windows\system32\Winrun.exe" "c:\windows\system32\Xred1.exe" "c:\windows\system32\Zred2.exe" . ADS - drivers: deleted 208 bytes in 1 streams. (((((((((((((((( Arquivos/Ficheiros criados de 2010-03-01 to 2010-04-01 )))))))))))))))))))))))))))) . 2010-03-26 18:22:01 . 2010-03-30 00:46:41 -------- d-----w- C:\HiJackThis 2010-03-26 18:04:29 . 2008-04-13 19:40:30 96512 ------w- C:\WINDOWS\system32\drivers\atapi.sys 2010-03-18 18:10:38 . 2010-03-18 18:10:40 -------- d-----w- C:\Arquivos de programas\Ares 2010-03-10 18:16:30 . 2010-03-10 18:16:30 -------- d-----w- C:\Documents and Settings\All Users\Dados de aplicativos\Soulseek 2010-03-10 14:49:50 . 2009-10-23 15:28:37 3558912 -c----w- C:\WINDOWS\system32\dllcache\moviemk.exe 2010-03-10 04:42:37 . 2010-03-10 04:42:37 1025536 -c----w- C:\WINDOWS\system32\dllcache\browseui.dll . ((((((((((((((((((((((((((((((((((((( Relatório Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-04-01 17:03:47 . 2001-10-28 15:07:18 49804 ----a-w- C:\WINDOWS\system32\perfc016.dat 2010-04-01 17:03:47 . 2001-10-28 15:07:18 347648 ----a-w- C:\WINDOWS\system32\perfh016.dat 2010-03-20 17:53:31 . 2009-11-08 22:52:20 -------- d-----w- C:\Arquivos de programas\BitComet 2010-03-20 16:36:44 . 2009-11-20 01:41:25 -------- d-----w- C:\Arquivos de programas\GbPlugin 2010-03-18 16:12:33 . 2009-11-08 22:51:49 -------- d-----w- C:\Documents and Settings\Guilherme Affonso\Dados de aplicativos\uTorrent 2010-02-26 05:42:31 . 2004-08-04 03:45:28 669184 ----a-w- C:\WINDOWS\system32\wininet.dll 2010-02-26 05:42:28 . 2004-08-04 03:45:24 81920 ----a-w- C:\WINDOWS\system32\ieencode.dll 2010-02-20 03:44:32 . 2009-11-08 22:51:55 -------- d-----w- C:\Arquivos de programas\uTorrent 2010-02-20 03:44:31 . 2010-02-20 03:44:31 1036288 ----a-w- C:\Documents and Settings\Guilherme Affonso\Dados de aplicativos\Mozilla\Firefox\Profiles\zjf8xx8l.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll 2010-02-16 02:27:28 . 2009-11-09 10:34:38 -------- d-----w- C:\Arquivos de programas\Arquivos comuns\Adobe . ((((((((((((((((((((((((((((( SnapShot@2010-03-27_23.26.57 ))))))))))))))))))))))))))))))))))))))))) . + 2010-04-01 18:38:52 . 2010-04-01 18:38:52 16384 C:\WINDOWS\Temp\Perflib_Perfdata_560.dat + 2001-10-28 15:07:18 . 2010-04-01 17:03:47 40972 C:\WINDOWS\system32\perfc009.dat - 2001-10-28 15:07:18 . 2010-03-27 23:25:16 40972 C:\WINDOWS\system32\perfc009.dat + 2004-08-04 03:45:24 . 2010-02-26 05:42:28 81920 C:\WINDOWS\system32\dllcache\ieencode.dll - 2004-08-04 03:45:24 . 2009-09-25 05:36:04 81920 C:\WINDOWS\system32\dllcache\ieencode.dll - 2004-08-04 03:45:28 . 2009-10-29 05:25:51 627712 C:\WINDOWS\system32\urlmon.dll + 2004-08-04 03:45:28 . 2010-02-26 05:42:31 627712 C:\WINDOWS\system32\urlmon.dll - 2001-10-28 15:07:18 . 2010-03-27 23:25:16 314644 C:\WINDOWS\system32\perfh009.dat + 2001-10-28 15:07:18 . 2010-04-01 17:03:47 314644 C:\WINDOWS\system32\perfh009.dat - 2004-08-04 03:45:24 . 2008-04-14 02:20:28 251904 C:\WINDOWS\system32\iepeers.dll + 2004-08-04 03:45:24 . 2010-02-26 05:42:28 251904 C:\WINDOWS\system32\iepeers.dll + 2009-09-25 05:36:05 . 2010-02-26 05:42:31 669184 C:\WINDOWS\system32\dllcache\wininet.dll - 2009-09-25 05:36:05 . 2009-10-29 05:25:52 669184 C:\WINDOWS\system32\dllcache\wininet.dll - 2009-09-25 05:36:05 . 2009-10-29 05:25:51 627712 C:\WINDOWS\system32\dllcache\urlmon.dll + 2009-09-25 05:36:05 . 2010-02-26 05:42:31 627712 C:\WINDOWS\system32\dllcache\urlmon.dll + 2010-02-26 05:42:28 . 2010-02-26 05:42:28 251904 C:\WINDOWS\system32\dllcache\iepeers.dll + 2004-08-04 03:45:28 . 2010-03-10 04:42:39 1509888 C:\WINDOWS\system32\shdocvw.dll - 2004-08-04 03:45:28 . 2009-10-29 05:25:51 1509888 C:\WINDOWS\system32\shdocvw.dll + 2004-08-04 03:45:24 . 2010-02-26 05:42:30 3094016 C:\WINDOWS\system32\mshtml.dll + 2009-09-25 05:36:05 . 2010-03-10 04:42:39 1509888 C:\WINDOWS\system32\dllcache\shdocvw.dll - 2009-09-25 05:36:05 . 2009-10-29 05:25:51 1509888 C:\WINDOWS\system32\dllcache\shdocvw.dll + 2009-09-25 05:36:04 . 2010-02-26 05:42:30 3094016 C:\WINDOWS\system32\dllcache\mshtml.dll - 2004-08-04 03:45:22 . 2008-04-14 02:20:24 1025536 C:\WINDOWS\system32\browseui.dll + 2004-08-04 03:45:22 . 2010-03-10 04:42:37 1025536 C:\WINDOWS\system32\browseui.dll . (((((((((((((((((((((((((( Pontos de Carregamento do Registro ))))))))))))))))))))))))))))))))))))))) . . *Nota* entradas vazias e legítimas por defeito não são mostradas. REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}"= "C:\Arquivos de programas\BS_Player\tbBS_1.dll" [bU] [HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}] C:\Arquivos de programas\BS_Player\tbBS_1.dll [bU] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}"= "C:\Arquivos de programas\BS_Player\tbBS_1.dll" [bU] [HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5}"= "C:\Arquivos de programas\BS_Player\tbBS_1.dll" [bU] [HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-24 23:02:00 8491008] "nwiz"="nwiz.exe" [2007-10-24 23:02:00 1626112] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-24 23:02:00 81920] "RTHDCPL"="RTHDCPL.EXE" [2008-03-26 08:14:12 16859136] "avast!"="C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 23:51:40 81000] "NeroFilterCheck"="C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe" [2008-02-27 15:03:24 570664] "SecurDisc"="C:\Arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe" [2008-02-18 16:36:24 1629480] "InCD"="C:\Arquivos de programas\Nero\Nero 7\InCD\InCD.exe" [2008-02-18 16:36:04 1057064] "Adobe Reader Speed Launcher"="C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 03:57:28 35760] "Adobe ARM"="C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 17:57:56 948672] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 02:20:54 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginAbn] 2009-10-22 16:01:04 310824 ----a-w- C:\ARQUIV~1\GbPlugin\gbiehAbn.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Arquivos de programas\\uTorrent\\uTorrent.exe"= "C:\\Arquivos de programas\\Messenger\\msmsgs.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Arquivos de programas\\BitComet\\BitComet.exe"= "C:\\Arquivos de programas\\Ares\\Ares.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "18940:TCP"= 18940:TCP:BitComet 18940 TCP "18940:UDP"= 18940:UDP:BitComet 18940 UDP R0 GbpKm;Gbp KernelMode;C:\WINDOWS\system32\drivers\GbpKm.sys [19/11/2009 22:41:26 31080] R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [8/11/2009 19:42:15 114768] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\drivers\aswFsBlk.sys [8/11/2009 19:42:15 20560] S2 GbpSv;Gbp Service;C:\ARQUIV~1\GbPlugin\GbpSv.exe --> C:\ARQUIV~1\GbPlugin\GbpSv.exe [?] S2 NeroRegInCDSrv;Nero Registry InCD Service;C:\Arquivos de programas\Nero\Nero 7\InCD\NBHRegInCDSrv.exe --> C:\Arquivos de programas\Nero\Nero 7\InCD\NBHRegInCDSrv.exe [?] S3 SetupNTGLM7X;SetupNTGLM7X;\??\D:\NTGLM7X.sys --> D:\NTGLM7X.sys [?] . . ------- Scan Suplementar ------- . IE: &B&aixar &com o BitComet - C:\Arquivos de programas\BitComet\BitComet.exe/AddLink.htm IE: &B&aixar todos os vídeos com o BitComet - C:\Arquivos de programas\BitComet\BitComet.exe/AddVideo.htm IE: &B&aixar tudo usando o BitComet - C:\Arquivos de programas\BitComet\BitComet.exe/AddAllLink.htm IE: E&xportar para o Microsoft Excel - C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - C:\Documents and Settings\Guilherme Affonso\Dados de aplicativos\Mozilla\Firefox\Profiles\zjf8xx8l.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1750559&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q= FF - component: C:\Documents and Settings\Guilherme Affonso\Dados de aplicativos\Mozilla\Firefox\Profiles\zjf8xx8l.default\extensions\{87F8774F-B485-47E2-A755-A40A8A5E8874}\components\GbMzhAbn.dll FF - component: C:\Documents and Settings\Guilherme Affonso\Dados de aplicativos\Mozilla\Firefox\Profiles\zjf8xx8l.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll FF - plugin: C:\Arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: C:\Arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll ---- FIREFOX POLICIES ---- C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false); C:\Arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true); C:\Arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); C:\Arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); C:\Arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br"); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-04-01 15:42:28 Windows 5.1.2600 Service Pack 3 NTFS Procurando processos ocultos ... Procurando entradas auto inicializáveis ocultas ... Procurando ficheiros/arquivos ocultos ... Varredura completada com sucesso arquivos/ficheiros ocultos: 0 ************************************************************************** . --------------------- DLLs Carregadas Sob os Processos em Execução --------------------- - - - - - - - > 'winlogon.exe'(700) C:\ARQUIV~1\GbPlugin\gbiehAbn.dll . Tempo para conclusão: 2010-04-01 15:43:22 ComboFix-quarantined-files.txt 2010-04-01 18:43:20 ComboFix2.txt 2010-03-30 00:42:16 Pré-execução: 9 pasta(s) 434.258.718.720 bytes disponíveis Pós execução: 10 pasta(s) 434.238.291.968 bytes disponíveis Current=10 Default=10 Failed=9 LastKnownGood=11 Sets=1,2,3,4,5,6,7,8,9,10,11 - - End Of File - - 0F3987992133785B2A965F78FDBB2FA8 Segue o log do hijackthis Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:49:47, on 1/4/2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\RTHDCPL.EXE C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe C:\Arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe C:\Arquivos de programas\Nero\Nero 7\InCD\InCD.exe C:\WINDOWS\system32\svchost.exe C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\wdfmgr.exe C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\wscntfy.exe C:\HiJackThis\HiJackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R3 - URLSearchHook: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Arquivos de programas\BS_Player\tbBS_1.dll (file missing) O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Arquivos de programas\BitComet\tools\BitCometBHO_1.4.1.10.dll O2 - BHO: G-Buster Browser Defense Banco Real - {C41A1C0E-EA6C-11D4-B1B8-444553540007} - C:\ARQUIV~1\GbPlugin\gbiehAbn.dll O2 - BHO: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Arquivos de programas\BS_Player\tbBS_1.dll (file missing) O3 - Toolbar: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Arquivos de programas\BS_Player\tbBS_1.dll (file missing) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [securDisc] C:\Arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe O4 - HKLM\..\Run: [inCD] C:\Arquivos de programas\Nero\Nero 7\InCD\InCD.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &B&aixar &com o BitComet - res://C:\Arquivos de programas\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &B&aixar todos os vídeos com o BitComet - res://C:\Arquivos de programas\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &B&aixar tudo usando o BitComet - res://C:\Arquivos de programas\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Arquivos de programas\BitComet\tools\BitCometBHO_1.4.1.10.dll/206 (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399007} (GbPluginObj Class) - https://wwws.realsecureweb.com.br/mpr/plugin/Cab/GbPluginABN.cab O17 - HKLM\System\CS3\Services\Tcpip\..\{298207B2-C2EA-4E2C-9BBD-1F24489FE553}: NameServer = 200.204.0.10 200.204.0.138 O17 - HKLM\System\CS4\Services\Tcpip\..\{298207B2-C2EA-4E2C-9BBD-1F24489FE553}: NameServer = 200.204.0.10 200.204.0.138 O20 - Winlogon Notify: GbPluginAbn - C:\ARQUIV~1\GbPlugin\gbiehAbn.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Gbp Service (GbpSv) - Unknown owner - C:\ARQUIV~1\GbPlugin\GbpSv.exe (file missing) O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: Nero Registry InCD Service (NeroRegInCDSrv) - Unknown owner - C:\Arquivos de programas\Nero\Nero 7\InCD\NBHRegInCDSrv.exe (file missing) O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 6658 bytes Aqui esta do forma que você pediu Muito obrigado desde ja Att, Guilherme Compartilhar este post Link para o post Compartilhar em outros sites
MGuitar 11 Denunciar post Postado Abril 1, 2010 Vá em Iniciar > Executar, digite Combofix /Uninstall e dê um OK para remover a ferramenta. Se existir, apague as pastas C:\ComboFix, C:\Qoobox e o arquivo C:\ComboFix.txt. Os logs estão limpos. Algum problema ainda? Faça o download do '>http://www.filehippo.com/download_ccleaner"]CCleaner e instale-o (sem instalar a toolbar do Yahoo ao término da instalação) Abra o programa e clique em Analisar > Correr Cleaner; Após, ao lado esquerdo do painel, clique em Registro > Procurar erros > Consertar erros. Compartilhar este post Link para o post Compartilhar em outros sites
Hipino 0 Denunciar post Postado Abril 3, 2010 Tudo feito da forma que você instruiu, nenhum problema detectado desde o final dos procedimentos. Muito obrigado, foi de incauculavel ajuda. Denovo muito obrigado por ter gasto seu tempo me ajudando. Att, Guilherme P Affonso Compartilhar este post Link para o post Compartilhar em outros sites
MGuitar 11 Denunciar post Postado Abril 5, 2010 PROBLEMA RESOLVIDO! Caso o autor necessite que o tópico seja reaberto basta enviar uma Mensagem Privada para um Moderador com um link para o tópico. Compartilhar este post Link para o post Compartilhar em outros sites
