[Resolvido!] Análise de log

João Prado · Abril 30, 2010

Meu computador tem apresentado problemas estranhos, por vezes estou utilizando algum software e o mesmo trava ou acontece de tocar aquele som do windows quando ocorre algum erro mas nem uma informação é exibida na tela.

Peço que algum analista dê uma olhada em meu log por favor.

Logfile of HijackThis v1.99.1

Scan saved at 13:03:35, on 30/04/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18241)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Ahead\InCD\InCDsrv.exe

C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

C:\Arquivos de programas\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\crypserv.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\ARQUIV~1\AVG\AVG8\avgam.exe

C:\ARQUIV~1\AVG\AVG8\avgrsx.exe

C:\Arquivos de programas\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Google\Google Talk\googletalk.exe

C:\Arquivos de programas\Java\jre1.6.0_03\bin\jusched.exe

C:\ARQUIV~1\AVG\AVG8\avgtray.exe

C:\Arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe

C:\Arquivos de programas\Ahead\InCD\InCD.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Arquivos de programas\IObit\Advanced SystemCare 3\AWC.exe

C:\Documents and Settings\joao.pedro.PETROPOL\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe

C:\Arquivos de programas\RocketDock\RocketDock.exe

C:\Documents and Settings\joao.pedro.PETROPOL\Configurações locais\Dados de aplicativos\Google\Update\1.2.183.23\GoogleCrashHandler.exe

C:\Arquivos de programas\Palm\Hotsync.exe

C:\Arquivos de programas\Java\jre1.6.0_03\bin\jucheck.exe

C:\Arquivos de programas\Windows Media Player\wmplayer.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Adobe\Adobe Dreamweaver CS3\Dreamweaver.exe

C:\Arquivos de programas\UltraVNC\winvnc.exe

C:\Arquivos de programas\Adobe\Adobe Fireworks CS3\Fireworks.exe

C:\WINDOWS\system32\notepad.exe

C:\WINDOWS\system32\WISPTIS.EXE

C:\ARQUIV~1\AVG\AVG8\avgnsx.exe

C:\Arquivos de programas\EasyPHP-5.3.2\EasyPHP-5.3.2.exe

C:\ARQUIV~1\EASYPH~1.2\Apache\bin\apache.exe

C:\ARQUIV~1\EASYPH~1.2\MySql\bin\mysqld.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\Microsoft Office\OFFICE11\OUTLOOK.EXE

C:\Arquivos de programas\AVG\AVG8\avgcsrvx.exe

C:\Arquivos de programas\Microsoft Office\OFFICE11\WINWORD.EXE

C:\Arquivos de programas\AVG\AVG8\avgcsrvx.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Arquivos de programas\Windows Live\Contacts\wlcomm.exe

G:\SOFTWARES PETROPOL\SPYWARE\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:9666

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG8\avgssie.dll

O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Arquivos de programas\Windows Live\Messenger\wlchtc.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: Site Advisor Module - {B2150688-1AA5-4698-90BE-C3CBECBB5786} - C:\Arquivos de programas\SAM\module.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [googletalk] C:\Arquivos de programas\Google\Google Talk\googletalk.exe /autostart

O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] C:\Arquivos de programas\Corel\Corel Graphics 12\Languages\BR\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=042110 serial=dr12wrx-0015510-wmu lang=BP

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Arquivos de programas\Arquivos comuns\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin

O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARQUIV~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [RemoteControl] "C:\Arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [inCD] C:\Arquivos de programas\Ahead\InCD\InCD.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Arquivos de programas\IObit\Advanced SystemCare 3\AWC.exe" /startup

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\joao.pedro.PETROPOL\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [RocketDock] "C:\Arquivos de programas\RocketDock\RocketDock.exe"

O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Arquivos de programas\Alcohol Soft\Alcohol 120\axcmd.exe" /automount

O4 - HKCU\..\Run: [AdobeUpdater] "C:\Arquivos de programas\Arquivos comuns\Adobe\Updater5\AdobeUpdater.exe"

O4 - Startup: Fireworks-AutoBackup.lnk = C:\Arquivos de programas\Fireworks-AutoBackup\Fireworks-AutoBackup.exe

O4 - Global Startup: Hotsync Manager.lnk = C:\Arquivos de programas\Palm\Hotsync.exe

O8 - Extra context menu item: Append to existing PDF - res://C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\arquivos de programas\bonjour\mdnsnsp.dll

O11 - Options group: [iNTERNATIONAL] International

O15 - Trusted Zone: http://www.sbradesco.kit.net

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = petropol.polimeros

O17 - HKLM\Software\..\Telephony: DomainName = petropol.polimeros

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = petropol.polimeros

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = petropol.polimeros

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Arquivos de programas\AVG\AVG8\avgpp.dll

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll

O23 - Service: Apache2 - Unknown owner - C:\ARQUIV~1\EASYPH~1.0B1\Apache\bin\apache.exe" -k runservice (file missing)

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Arquivos de programas\Bonjour\mDNSResponder.exe

O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Arquivos de programas\Ahead\InCD\InCDsrv.exe

O23 - Service: MySQL - Unknown owner - C:\ARQUIV~1\EASYPH~1.0B1\MySql\bin\mysqld.exe (file missing)

O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Arquivos de programas\Arquivos comuns\SolidWorks Shared\Service\SolidWorksLicensing.exe

O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Arquivos de programas\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

Agradeço desde já

wings · Maio 1, 2010

Bom dia MoOiO.....

*O PROCEDIMENTO ABAIXO SÓ PODERÁ SER FEITO USANDO O INTERNET EXPLORER

*Desative seu antivírus temporariamente

Iniciar > Programas > AVG
Abra a Interface do usuário do AVG

Clique duas vezes na Proteção Residente

Desmarque a opção "Proteção Residente ativa"

Salve as alterações

*Faça um scan online com o NOD32 seguindo este tutorial

*Ao término cole o relatório criado em C:\Arquivos de programas\EsetOnlineScanner\log

João Prado · Maio 3, 2010

ok, o problea ocorre no pc da empresa entao segunda executo o procedimentos

obrigado pela atenção

Esta ocorrendo um probleminha aqui, o site não esta carregando :ermm:

wings · Maio 3, 2010

Tente com o BitDefender

*Ao término cole o resultado criado em C:\Windows\BDOSCAN8\bdoscan.log

João Prado · Maio 4, 2010

beleza verificação encerrada e agora?

wings · Maio 4, 2010

beleza verificação encerrada e agora?

*Ao término cole o resultado criado em C:\Windows\BDOSCAN8\bdoscan.log

João Prado · Maio 4, 2010

ahh certo hehe

[General]

App = "楂䑴晥湥敤⁲湏楬敮匠慣湮牥 v8"

Date = 04:05:2010

Time = 12:35:45

Scan Path = C:\;D:\;

[Engines Info]

Virus Definitions = 5745334

Engine build = "AVCORE v2.1 Windows/i386 11.0.0.33 (Feb 25 2010)"

Scan plugins = 17

Archive plugins = 43

Unpack plugins = 10

E-mail plugins = 6

System plugins = 4

[scan Statistics]

Folders = 24969

Files = 1911153

Archives = 10070

Packed files = 140341

Identified viruses = 5

Infected files = 14

Warnings = 0

Suspect files = 0

Disinfected files = 0

Deleted files = 14

Copied files = 0

Moved files = 0

Renamed files = 0

I/O Errors = 53

[scan Settings]

SecondAction = Delete

FirstAction = Disinfect

Heuristics = 1

Enable Warnings = 1

Exclude Ext =

Extensions = *;

Scan Emails = 1

Scan Archives = 1

Scan Packed = 1

Scan Files = 1

Scan Boot = 1

Verify Memory = 0

[scan Results]

Line00000035 = "C:\Arquivos de programas\Adobe\Adobe Flash CS4\adobe.flash.cs4.v10.0.professional-patch.exe Infected with: Backdoor.Generic.131533"

Line00000034 = "C:\Arquivos de programas\Adobe\Adobe Flash CS4\adobe.flash.cs4.v10.0.professional-patch.exe Deleted"

Line00000033 = "C:\autorun.inf Infected with: Trojan.AutorunINF.Gen"

Line00000032 = "C:\autorun.inf Deleted"

Line00000031 = "C:\Documents and Settings\joao.pedro.PETROPOL\Dados de aplicativos\Thinstall\CorelDRAW Graphics Suite X3\4000003000002i\CorelDRW.exe Infected with: Trojan.Generic.3285573"

Line00000030 = "C:\Documents and Settings\joao.pedro.PETROPOL\Dados de aplicativos\Thinstall\CorelDRAW Graphics Suite X3\4000003000002i\CorelDRW.exe Deleted"

Line00000029 = "C:\Documents and Settings\joao.pedro.PETROPOL\Desktop\Docs\mailpv.rar=>mailpv\mailpv.exe Infected with: Trojan.Downloader.Small.74"

Line00000028 = "C:\Documents and Settings\joao.pedro.PETROPOL\Desktop\Docs\mailpv.rar=>mailpv\mailpv.exe Deleted"

Line00000027 = "C:\Documents and Settings\joao.pedro.PETROPOL\Desktop\Docs\mailpv.rar Update failed"

Line00000026 = "C:\Documents and Settings\joao.pedro.PETROPOL\Meus documentos\Downloads\Old\ABCrack_www.therebels.de_by.Bridge.zip=>shock/adobe.flash.cs4.v10.0.professional-patch.exe Infected with: Backdoor.Generic.131533"

Line00000025 = "C:\Documents and Settings\joao.pedro.PETROPOL\Meus documentos\Downloads\Old\ABCrack_www.therebels.de_by.Bridge.zip=>shock/adobe.flash.cs4.v10.0.professional-patch.exe Deleted"

Line00000024 = "C:\Documents and Settings\joao.pedro.PETROPOL\Meus documentos\Downloads\Old\ABCrack_www.therebels.de_by.Bridge.zip Updated"

Line00000023 = "C:\Documents and Settings\joao.pedro.PETROPOL\Meus documentos\Downloads\Old\AFCS4(www.therebels.de)by.Bridge.rar=>crack.zip=>shock/adobe.flash.cs4.v10.0.professional-patch.exe Infected with: Backdoor.Generic.131533"

Line00000022 = "C:\Documents and Settings\joao.pedro.PETROPOL\Meus documentos\Downloads\Old\AFCS4(www.therebels.de)by.Bridge.rar=>crack.zip=>shock/adobe.flash.cs4.v10.0.professional-patch.exe Deleted"

Line00000021 = "C:\Documents and Settings\joao.pedro.PETROPOL\Meus documentos\Downloads\Old\AFCS4(www.therebels.de)by.Bridge.rar=>crack.zip Updated"

Line00000020 = "C:\Documents and Settings\joao.pedro.PETROPOL\Meus documentos\Downloads\Old\AFCS4(www.therebels.de)by.Bridge.rar Update failed"

Line00000019 = "C:\Documents and Settings\joao.pedro.PETROPOL\Meus documentos\Downloads\Old\crack.zip=>shock/adobe.flash.cs4.v10.0.professional-patch.exe Infected with: Backdoor.Generic.131533"

Line00000018 = "C:\Documents and Settings\joao.pedro.PETROPOL\Meus documentos\Downloads\Old\crack.zip=>shock/adobe.flash.cs4.v10.0.professional-patch.exe Deleted"

Line00000017 = "C:\Documents and Settings\joao.pedro.PETROPOL\Meus documentos\Downloads\Old\crack.zip Updated"

Line00000016 = "C:\Documents and Settings\joao.pedro.PETROPOL\Meus documentos\Downloads\Old\shock\adobe.flash.cs4.v10.0.professional-patch.exe Infected with: Backdoor.Generic.131533"

Line00000015 = "C:\Documents and Settings\joao.pedro.PETROPOL\Meus documentos\Downloads\Old\shock\adobe.flash.cs4.v10.0.professional-patch.exe Deleted"

Line00000014 = "C:\rcmsqb.exe Infected with: Gen:Trojan.Heur.AutoIT.ar3@bKDu!6dO"

Line00000013 = "C:\rcmsqb.exe Disinfection failed"

Line00000012 = "C:\rcmsqb.exe Deleted"

Line00000011 = "C:\System Volume Information\_restore{F7D6AD5B-B62A-4C35-AC00-F6CFF31F20F7}\RP267\A0067096.exe Infected with: Gen:Trojan.Heur.AutoIT.ar3@bKDu!6dO"

Line00000010 = "C:\System Volume Information\_restore{F7D6AD5B-B62A-4C35-AC00-F6CFF31F20F7}\RP267\A0067096.exe Disinfection failed"

Line00000009 = "C:\System Volume Information\_restore{F7D6AD5B-B62A-4C35-AC00-F6CFF31F20F7}\RP267\A0067096.exe Deleted"

Line00000008 = "C:\System Volume Information\_restore{F7D6AD5B-B62A-4C35-AC00-F6CFF31F20F7}\RP272\A0067269.exe Infected with: Backdoor.Generic.131533"

Line00000007 = "C:\System Volume Information\_restore{F7D6AD5B-B62A-4C35-AC00-F6CFF31F20F7}\RP272\A0067269.exe Deleted"

Line00000006 = "C:\System Volume Information\_restore{F7D6AD5B-B62A-4C35-AC00-F6CFF31F20F7}\RP272\A0067270.inf Infected with: Trojan.AutorunINF.Gen"

Line00000005 = "C:\System Volume Information\_restore{F7D6AD5B-B62A-4C35-AC00-F6CFF31F20F7}\RP272\A0067270.inf Deleted"

Line00000004 = "C:\System Volume Information\_restore{F7D6AD5B-B62A-4C35-AC00-F6CFF31F20F7}\RP272\A0067271.exe Infected with: Trojan.Generic.3285573"

Line00000003 = "C:\System Volume Information\_restore{F7D6AD5B-B62A-4C35-AC00-F6CFF31F20F7}\RP272\A0067271.exe Deleted"

Line00000002 = "C:\System Volume Information\_restore{F7D6AD5B-B62A-4C35-AC00-F6CFF31F20F7}\RP272\A0067272.exe Infected with: Gen:Trojan.Heur.AutoIT.ar3@bKDu!6dO"

Line00000001 = "C:\System Volume Information\_restore{F7D6AD5B-B62A-4C35-AC00-F6CFF31F20F7}\RP272\A0067272.exe Disinfection failed"

Line00000000 = "C:\System Volume Information\_restore{F7D6AD5B-B62A-4C35-AC00-F6CFF31F20F7}\RP272\A0067272.exe Deleted"

wings · Maio 4, 2010

1.

*Delete a pasta C:\Windows\BDOSCAN8

2.

*Baixe o MalwareBytes Anti-malware e salve-o no desktop

*Instale o programa

*Se alguma atualização existir,o download será automático. Aguarde...

*O programa será aberto automaticamente.

*Na aba [Verificação], selecione a opção [Verificação completa]

*Clique em [Verificar] e selecione as unidades a serem examinadas

*Ao término do scan, poderá ser interrogado se deseja remover objetos da memória. Clique [sIM] > [OK] > [Mostrar Resultados]

*Clique em [Remover Selecionados]

*Um relatório (mbam-log-ano-mês-data.txt) será apresentado.

*Cole-o na sua próxima resposta

João Prado · Maio 5, 2010

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Versão da Base de Dados: 4068

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18241

05/05/2010 12:36:01

mbam-log-2010-05-05 (12-36-01).txt

Tipo de Verificação: Verificação Completa (C:\|)

Objetos escaneados: 432115

Tempo decorrido: 1 hora(s), 45 minuto(s), 13 segundo(s)

Processos de Memória Infectados: 0

Módulos de Memória Infectados: 0

Chaves de Registro Infectadas: 0

Valores de Registro Infectados: 0

Itens de Dados no Registro Infectados: 0

Pastas Infectadas: 0

Arquivos Infectados: 7

Processos de Memória Infectados: