[Arquivado] Não consigo instalar nenhum antivirus

[M1NG4W 0]

Olá, gostaria de uma ajuda para instalar antivirus no meu pc

ja tentei instalar o avast, nod32, kaspersky, entre outros e nenhum deu certo

tem como alguem me ajudar?

 

Aqui vai meu log pelo hijack

 

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 12:28:01, on 4/5/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal

 

Running processes:

D:\WINDOWS\System32\smss.exe

D:\WINDOWS\system32\winlogon.exe

D:\WINDOWS\system32\services.exe

D:\WINDOWS\system32\lsass.exe

D:\WINDOWS\system32\svchost.exe

D:\WINDOWS\System32\svchost.exe

D:\WINDOWS\system32\spoolsv.exe

D:\WINDOWS\Explorer2.exe

D:\WINDOWS\system32\RUNDLL32.EXE

D:\WINDOWS\system32\ctfmon.exe

D:\Arquivos de programas\Free Download Manager\fdm.exe

D:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

D:\Arquivos de programas\Skype\Phone\Skype.exe

D:\Arquivos de programas\Software Informer\softinfo.exe

D:\WINDOWS\system32\nvsvc32.exe

D:\WINDOWS\system32\wscntfy.exe

D:\Arquivos de programas\Skype\Plugin Manager\skypePM.exe

D:\WINDOWS\system32\wuauclt.exe

D:\WINDOWS\system32\wuauclt.exe

D:\Arquivos de programas\Mozilla Firefox\firefox.exe

D:\Arquivos de programas\Skype\Toolbars\Shared\SkypeNames2.exe

C:\Downloads\Software\HiJackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.codecguide.com/

F2 - REG:system.ini: Shell=Explorer2.exe

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - D:\Arquivos de programas\Free Download Manager\iefdm2.dll

O4 - HKLM\..\Run: [TBPanel] D:\Arquivos de programas\Vtune\TBPanel.exe /A

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [egui] "D:\Arquivos de programas\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Free Download Manager] D:\Arquivos de programas\Free Download Manager\fdm.exe -autorun

O4 - HKCU\..\Run: [msnmsgr] "D:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [skype] "D:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "D:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [software Informer] "D:\Arquivos de programas\Software Informer\softinfo.exe" -autorun

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: Add to AMV Converter... - D:\Arquivos de programas\MP3 Player Utilities 4.15\AMVConverter\grab.html

O8 - Extra context menu item: Baixar com o Free Download Manager - file://D:\Arquivos de programas\Free Download Manager\dllink.htm

O8 - Extra context menu item: Baixar tudo com o Free Download Manager - file://D:\Arquivos de programas\Free Download Manager\dlall.htm

O8 - Extra context menu item: Baixar vídeo com o Free Download Manager - file://D:\Arquivos de programas\Free Download Manager\dlfvideo.htm

O8 - Extra context menu item: Download selecionado pelo Free Download Manager - file://D:\Arquivos de programas\Free Download Manager\dlselected.htm

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://D:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: MediaManager tool grab multimedia file - D:\Arquivos de programas\MP3 Player Utilities 4.15\MediaManager\grab.html

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL

O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Daemon de cache de categorias de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\system32\browseui.dll

O23 - Service: ESET HTTP Server (EhttpSrv) - Unknown owner - D:\Arquivos de programas\ESET\ESET NOD32 Antivirus\EHttpSrv.exe (file missing)

O23 - Service: ESET Service (ekrn) - ESET - D:\Arquivos de programas\ESET\ESET NOD32 Antivirus\ekrn.exe

O23 - Service: NBService - Nero AG - D:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - D:\WINDOWS\system32\GameMon.des.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe

 

--

End of file - 5852 bytes

[wings 22]

Boa tarde....

 

 

*O PROCEDIMENTO ABAIXO SÓ PODERÁ SER FEITO USANDO O INTERNET EXPLORER

*Faça um scan online com o BitDefender seguindo este tutorial

*Ao término cole o resultado criado em C:\Windows\BDOSCAN8\bdoscan.log

[M1NG4W 0]

Boa tarde....

 

 

*O PROCEDIMENTO ABAIXO SÓ PODERÁ SER FEITO USANDO O INTERNET EXPLORER

*Faça um scan online com o BitDefender seguindo este'>http://dicasetutoriaisparapc.blogspot.com/2009/04/tutorial-do-antivirus-bitdefender.html"]este tutorial

*Ao término cole o resultado criado em C:\Windows\BDOSCAN8\bdoscan.log

 

Nao está entrando no site do scan, tem alguma outra coisa que eu poça fazer?

Meu pc tambem esta com esse erro aqui, fica aparecendo essa mensagem, http://i40.tinypic.com/2rw468m.jpg

[wings 22]

*Acesse o site ConfickerWorkingGroup

*Interprete e informe.

[M1NG4W 0]

*Acesse o site ConfickerWorkingGroup'>http://www.confickerworkinggroup.org/infection_test/cfeyechart.html"]ConfickerWorkingGroup

*Interprete e informe.

 

Não consigo acessar o site ;s

tentei pelo firefox e pelo internet explorer.

[wings 22]

*Baixe o ComboFix e salve-o no desktop

 

*Execute o Combofix e aceite o contrato

 

*Se o console de recuperação do Windows já estiver instalado, o ComboFix continuará o processo automaticamente. Caso contrário, clique em [sIM] para a sua instalação.

 

 

*Clique em [sIM] para continuar.

 

 

*Aguarde a conclusão de todas as etapas

 

 

*Enquanto o ComboFix estiver em execução, evite usar o mouse e o teclado!!..... Para interromper o procedimento tecle N ou 2 e depois ENTER.

 

*O programa será fechado automaticamente

 

*Cole o relatório criado em C:\combofix.txt

[M1NG4W 0]

*Baixe o ComboFix'>http://download.bleepingcomputer.com/sUBs/ComboFix.exe"]ComboFix e salve-o no desktop

 

*Execute o Combofix e aceite o contrato

 

*Se o console de recuperação do Windows já estiver instalado, o ComboFix continuará o processo automaticamente. Caso contrário, clique em [sIM] para a sua instalação.

 

 

*Clique em [sIM] para continuar.

 

 

*Aguarde a conclusão de todas as etapas

 

 

*Enquanto o ComboFix estiver em execução, evite usar o mouse e o teclado!!..... Para interromper o procedimento tecle N ou 2 e depois ENTER.

 

*O programa será fechado automaticamente

 

*Cole o relatório criado em C:\combofix.txt

 

ComboFix 10-05-07.03 - Ítalo 07/05/2010 18:19:45.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.2047.1671 [GMT -4:00]

Executando de: c:\downloads\Software\ComboFix.exe

AV: ESET Smart Security 4.0 *On-access scanning disabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FW: Avira FireWall *disabled* {11638345-E4FC-4BEE-BB73-EC754659C5F6}

.

ADS - WINDOWS: deleted 24 bytes in 1 streams.

 

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

 

d:\documents and settings\xD\Dados de aplicativos\Wplugin.dll

d:\windows\Alcmtr.exe

d:\windows\explorer.exe.local

d:\windows\system32\vbzlib1.dll

d:\windows\Wplugin.dll

d:\windows\ws2help.dll

 

.

((((((((((((((((((((((((((((((((((((((( Drivers/Serviços )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

-------\Legacy_ASC3360PR

-------\Service_asc3360pr

 

 

(((((((((((((((( Arquivos/Ficheiros criados de 2010-04-07 to 2010-05-07 ))))))))))))))))))))))))))))

.

 

2010-05-05 23:36 . 2010-05-05 23:36 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\SRS Labs

2010-05-05 23:36 . 2009-12-15 18:41 268912 ----a-r- d:\windows\system32\drivers\SRS_SSCFilter_i386.sys

2010-05-05 23:36 . 2010-05-05 23:36 -------- d-----w- d:\arquivos de programas\SRS Labs

2010-05-03 04:45 . 2010-05-03 04:45 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\ESET

2010-05-03 04:45 . 2010-05-03 04:45 -------- d-----w- d:\arquivos de programas\ESET

2010-05-01 01:41 . 2010-05-01 01:41 -------- d-----w- d:\arquivos de programas\Software Informer

2010-05-01 01:26 . 2010-05-01 01:31 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Avira

2010-04-29 17:26 . 2010-04-29 17:26 -------- d-----w- D:\OnGame

2010-04-28 02:08 . 2005-01-01 09:43 4682 ----a-w- d:\windows\system32\npptNT2.sys

2010-04-28 01:55 . 2010-04-28 01:55 -------- d-----w- D:\Program Files

2010-04-28 01:13 . 2010-04-28 18:39 -------- d-----w- d:\arquivos de programas\OnGame

2010-04-23 23:10 . 2010-04-23 23:10 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Common Share

2010-04-23 23:10 . 2008-12-18 17:38 719872 ----a-w- d:\windows\system32\devil.dll

2010-04-23 23:10 . 2008-12-18 17:38 351744 ----a-w- d:\windows\system32\avisynth.dll

2010-04-23 23:10 . 2008-12-18 17:38 1700352 ----a-w- d:\windows\system32\gdiplus.dll

2010-04-23 23:10 . 2010-04-23 23:10 -------- d-----w- d:\arquivos de programas\OJOsoft

2010-04-23 23:10 . 2008-12-18 17:38 1060864 ----a-w- d:\windows\system32\mfc71.dll

2010-04-18 06:40 . 2010-04-23 00:54 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Messenger Plus!

2010-04-18 06:39 . 2010-04-18 06:39 -------- d-----w- d:\arquivos de programas\Messenger Plus! Live

2010-04-15 21:02 . 2010-04-15 21:02 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Ahead

2010-04-14 23:55 . 2010-04-14 23:55 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Pianosoft

2010-04-14 23:55 . 2010-04-14 23:55 -------- d-----w- d:\arquivos de programas\Free MP3 Converter

2010-04-14 23:55 . 2001-04-27 19:11 24576 ----a-w- d:\windows\system32\SmartSubClass.dll

2010-04-14 17:16 . 2010-04-14 17:29 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Blizzard Entertainment

2010-04-14 16:58 . 2010-04-14 16:58 -------- d-----w- d:\arquivos de programas\Nero

2010-04-14 16:58 . 2010-04-14 17:02 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Ahead

2010-04-13 11:02 . 2010-04-14 17:12 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Blizzard Entertainment

2010-04-13 11:01 . 2010-04-13 11:01 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Blizzard

2010-04-11 00:46 . 2010-04-15 17:28 -------- d-----w- d:\arquivos de programas\MuAwaY

2010-04-11 00:18 . 2010-04-11 00:18 -------- d-----w- D:\MicroProse

2010-04-11 00:18 . 1997-05-29 19:29 315904 ----a-w- d:\windows\IsUn0416.exe

2010-04-11 00:13 . 2010-04-11 00:16 -------- d-----w- d:\arquivos de programas\Worms2

2010-04-11 00:01 . 2010-04-11 00:01 -------- d-----w- d:\arquivos de programas\SlySoft

2010-04-10 22:57 . 2010-04-10 22:57 -------- d-----w- d:\windows\system32\windows media

2010-04-10 22:57 . 2010-04-10 22:57 -------- d-----w- d:\arquivos de programas\Windows Media Components

2010-04-09 18:34 . 2010-04-09 18:34 -------- d-----w- d:\arquivos de programas\DownloadToolz

2010-04-09 10:33 . 2010-04-09 10:33 -------- d-----w- d:\arquivos de programas\DsNET Corp

2010-04-09 10:24 . 2010-04-09 10:24 34 ---ha-w- d:\windows\system32\DVDRippper_sysquict.dat

2010-04-09 10:24 . 2010-04-09 10:36 -------- d-----w- d:\arquivos de programas\Abcc Free Youtube FLV Video Downloader&Converter

2010-04-08 10:47 . 2010-04-11 00:17 47104 ----a-w- d:\windows\system32\KMVIDC32.DLL

2010-04-08 10:42 . 2010-04-08 10:42 -------- d-----w- d:\arquivos de programas\WinISO53

2010-04-08 10:31 . 2010-04-08 10:31 691696 ----a-w- d:\windows\system32\drivers\sptd.sys

2010-04-08 10:28 . 2010-04-08 10:29 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\DAEMON Tools Lite

2010-04-08 01:37 . 2010-04-08 01:37 -------- d-----w- d:\arquivos de programas\ZaraSoft

2010-04-08 01:33 . 2010-04-08 01:33 -------- d-----w- d:\arquivos de programas\Windows Live Safety Center

 

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-05-02 11:30 . 2010-03-29 16:53 -------- d-----w- d:\arquivos de programas\MPC HomeCinema

2010-05-01 01:41 . 2010-03-19 19:01 -------- d-----w- d:\arquivos de programas\Free Download Manager

2010-05-01 01:30 . 2010-03-19 18:38 -------- d-----w- d:\arquivos de programas\Vtune

2010-04-18 01:15 . 2010-03-19 18:45 -------- d-----w- d:\arquivos de programas\K-Lite Codec Pack

2010-04-17 23:55 . 2001-10-28 17:07 48846 ----a-w- d:\windows\system32\perfc016.dat

2010-04-17 23:55 . 2001-10-28 17:07 344734 ----a-w- d:\windows\system32\perfh016.dat

2010-04-06 09:54 . 2010-04-06 09:54 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Ubisoft

2010-04-06 09:45 . 2010-04-06 09:45 -------- d-----w- d:\arquivos de programas\Ubisoft

2010-04-06 09:45 . 2010-03-19 18:42 -------- d--h--w- d:\arquivos de programas\InstallShield Installation Information

2010-04-05 18:00 . 2010-04-05 18:00 -------- d-----w- d:\arquivos de programas\MP3 Player Utilities 4.15

2010-04-05 12:36 . 2010-04-05 12:36 -------- d-----w- d:\arquivos de programas\Foxit Software

2010-03-27 20:28 . 2010-03-27 20:24 -------- d-----w- d:\arquivos de programas\Winamp

2010-03-27 20:27 . 2010-03-27 20:27 -------- d-----w- d:\arquivos de programas\Winamp Detect

2010-03-25 19:55 . 2010-03-25 19:55 56 ---ha-w- d:\windows\system32\ezsidmv.dat

2010-03-25 19:54 . 2010-03-25 19:53 -------- d-----r- d:\arquivos de programas\Skype

2010-03-25 19:53 . 2010-03-25 19:53 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Skype

2010-03-25 19:53 . 2010-03-25 19:53 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Skype

2010-03-24 23:13 . 2010-03-19 18:32 86327 ----a-w- d:\windows\pchealth\helpctr\OfflineCache\index.dat

2010-03-23 23:07 . 2010-03-23 23:07 -------- d-----w- d:\arquivos de programas\Microsoft

2010-03-23 23:07 . 2010-03-23 23:07 -------- d-----w- d:\arquivos de programas\Windows Live

2010-03-23 23:07 . 2010-03-23 23:07 -------- d-----w- d:\arquivos de programas\Windows Live SkyDrive

2010-03-23 22:55 . 2010-03-23 22:55 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Windows Live

2010-03-23 01:30 . 2010-03-23 01:22 -------- d-----w- d:\arquivos de programas\Frets on Fire

2010-03-22 22:36 . 2010-03-22 17:49 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\NOS

2010-03-22 18:13 . 2010-03-22 18:13 -------- d-----w- d:\arquivos de programas\Arquivos comuns\DVDVideoSoft

2010-03-22 18:13 . 2010-03-22 18:13 -------- d-----w- d:\arquivos de programas\DVDVideoSoft

2010-03-22 18:04 . 2010-03-22 18:04 -------- d-----w- d:\arquivos de programas\VDownloader

2010-03-22 17:51 . 2010-03-22 17:49 2089299 ----a-w- d:\documents and settings\All Users\Dados de aplicativos\NOS\Adobe_Downloads\install_flash_player.exe

2010-03-19 19:07 . 2010-03-19 19:07 0 ----a-w- d:\windows\nsreg.dat

2010-03-19 19:01 . 2010-03-19 19:01 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\FreeDownloadManager.ORG

2010-03-19 18:58 . 2010-03-19 18:58 -------- d-----w- d:\arquivos de programas\uTorrent

2010-03-19 18:42 . 2010-03-19 18:42 -------- d-----w- d:\arquivos de programas\Realtek

2010-03-19 18:42 . 2010-03-19 18:42 315392 ----a-w- d:\windows\HideWin.exe

2010-03-19 18:39 . 2010-03-19 18:39 -------- d-----w- d:\arquivos de programas\Arquivos comuns\InstallShield

2010-03-19 18:33 . 2010-03-19 18:33 -------- d-----w- d:\arquivos de programas\microsoft frontpage

2010-03-19 18:31 . 2010-03-19 18:31 -------- d-----w- d:\arquivos de programas\Serviços on-line

2010-03-19 18:31 . 2010-03-19 18:31 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Serviços

2010-03-19 18:29 . 2010-03-19 18:29 21844 ----a-w- d:\windows\system32\emptyregdb.dat

.

 

------- Sigcheck -------

 

[-] 2008-06-10 . ACCF5A9A1FFAA490F33DBA1C632B95E1 . 361344 . . [5.1.2600.5512] . . d:\windows\system32\drivers\tcpip.sys

 

[-] 2008-06-10 . 1F2AA1B3D35E7ACFC3ECA27FFA9DA90A . 1571840 . . [5.1.2600.5512] . . d:\windows\system32\sfcfiles.dll

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Free Download Manager"="d:\arquivos de programas\Free Download Manager\fdm.exe" [2009-01-31 3399727]

"msnmsgr"="d:\arquivos de programas\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3953472]

"Skype"="d:\arquivos de programas\Skype\Phone\Skype.exe" [2009-10-09 25623336]

"Software Informer"="d:\arquivos de programas\Software Informer\softinfo.exe" [2009-11-25 2011205]

"SRS Audio Sandbox"="d:\arquivos de programas\SRS Labs\Audio Sandbox\SRSSSC.exe" [2010-01-07 3216664]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="d:\windows\system32\NvCpl.dll" [2008-01-08 8523776]

"NvMediaCenter"="d:\windows\system32\NvMcTray.dll" [2008-01-08 81920]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="d:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]

2009-01-29 22:20 139264 ----a-w- d:\arquivos de programas\SlySoft\CloneCD\CloneCDTray.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

2006-01-12 19:40 229376 ----a-w- d:\arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]

2008-01-08 17:53 1703936 ----a-w- d:\windows\system32\nwiz.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]

2007-07-05 19:08 16380416 ----a-w- d:\windows\RTHDCPL.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]

2007-06-15 19:45 1900544 ----a-w- d:\windows\SkyTel.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]

2009-12-18 00:30 113152 ----a-w- d:\arquivos de programas\Winamp\winampa.exe

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"d:\\Arquivos de programas\\uTorrent\\uTorrent.exe"=

"d:\\Arquivos de programas\\Messenger\\msmsgs.exe"=

"d:\\Arquivos de programas\\Mozilla Firefox\\firefox.exe"=

"d:\\Arquivos de programas\\K-Lite Codec Pack\\Media Player Classic\\mplayerc.exe"=

"d:\\Arquivos de programas\\Skype\\Plugin Manager\\skypePM.exe"=

"d:\\WINDOWS\\system32\\SNDVOL32.EXE"=

"c:\\ONGAME\\AsdaStory\\system\\log\\Error Exception Request.err"= c:\\ONGAME\\AsdaStory\\system\\log\\Error Exception Request.Err

"d:\\Arquivos de programas\\Winamp\\winamp.exe"=

"c:\\Downloads\\xpadder_gamepad_profiler\\Xpadder.exe"=

"d:\\Arquivos de programas\\Microsoft Office\\OFFICE11\\WINWORD.EXE"=

"d:\\Arquivos de programas\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=

"d:\\Arquivos de programas\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=

"d:\\Arquivos de programas\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=

"d:\\Arquivos de programas\\Skype\\Toolbars\\Shared\\SkypeNames2.exe"=

"d:\\WINDOWS\\Explorer2.exe"=

"c:\\World of Warcraft\\WoW-3.2.0-enUS-downloader.exe"=

"c:\\World of Warcraft\\Launcher.exe"=

"d:\\WINDOWS\\system32\\wuauclt.exe"=

"d:\\Arquivos de programas\\Free Download Manager\\fdm.exe"=

"d:\\Arquivos de programas\\Windows Media Components\\Encoder\\wmenc.exe"=

"d:\\Documents and Settings\\Ítalo\\Meus documentos\\josenaldo.exe"=

"d:\\Arquivos de programas\\Windows Media Player\\wmplayer.exe"=

"d:\\OnGame\\GunBoundWC\\GunBound.gme"=

"d:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"=

"d:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"d:\\Arquivos de programas\\Software Informer\\softinfo.exe"=

"d:\\OnGame\\GunBoundWC\\NyxLauncher.exe"=

"d:\\Arquivos de programas\\SRS Labs\\Audio Sandbox\\SRSSSC.exe"=

"d:\\Arquivos de programas\\Skype\\Phone\\Skype.exe"=

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

 

R0 sptd;sptd;d:\windows\system32\drivers\sptd.sys [8/4/2010 06:31 691696]

R1 ehdrv;ehdrv;d:\windows\system32\drivers\ehdrv.sys [29/9/2009 13:02 108792]

R1 epfwtdir;epfwtdir;d:\windows\system32\drivers\epfwtdir.sys [29/9/2009 13:05 96408]

R2 ekrn;ESET Service;d:\arquivos de programas\ESET\ESET NOD32 Antivirus\ekrn.exe [29/9/2009 13:03 735960]

R3 ip100xp;IC Plus IP100 10/100 Fast Ethernet Adapter NT Driver;d:\windows\system32\drivers\ipfnd51.sys [19/3/2010 14:44 26752]

S3 npggsvc;nProtect GameGuard Service;d:\windows\system32\GameMon.des -service --> d:\windows\system32\GameMon.des -service [?]

.

.

------- Scan Suplementar -------

.

uInternet Connection Wizard,ShellNext = hxxp://www.codecguide.com/

IE: Add to AMV Converter... - d:\arquivos de programas\MP3 Player Utilities 4.15\AMVConverter\grab.html

IE: Baixar com o Free Download Manager - file://d:\arquivos de programas\Free Download Manager\dllink.htm

IE: Baixar tudo com o Free Download Manager - file://d:\arquivos de programas\Free Download Manager\dlall.htm

IE: Baixar vídeo com o Free Download Manager - file://d:\arquivos de programas\Free Download Manager\dlfvideo.htm

IE: Download selecionado pelo Free Download Manager - file://d:\arquivos de programas\Free Download Manager\dlselected.htm

IE: E&xportar para o Microsoft Excel - d:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: MediaManager tool grab multimedia file - d:\arquivos de programas\MP3 Player Utilities 4.15\MediaManager\grab.html

FF - ProfilePath - d:\documents and settings\Ítalo\Dados de aplicativos\Mozilla\Firefox\Profiles\pxvzk0a5.default\

FF - component: d:\arquivos de programas\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll

FF - component: d:\arquivos de programas\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll

FF - plugin: d:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

FF - plugin: d:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

FF - plugin: d:\arquivos de programas\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll

FF - plugin: d:\arquivos de programas\Mozilla Firefox\plugins\npwachk.dll

 

---- FIREFOX POLICIES ----

d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);

d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);

d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);

d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

.

- - - - ORFÃOS REMOVIDOS - - - -

 

HKCU-Run-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - d:\arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe

HKCU-Run-fsm - (no file)

HKLM-Run-TBPanel - d:\arquivos de programas\Vtune\TBPanel.exe

HKLM-Run-egui - d:\arquivos de programas\ESET\ESET NOD32 Antivirus\egui.exe

MSConfigStartUp-Alcmtr - ALCMTR.EXE

MSConfigStartUp-DAEMON Tools Lite - d:\arquivos de programas\DAEMON Tools Lite\DTLite.exe

 

 

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-05-07 18:23

Windows 5.1.2600 Service Pack 3 NTFS

 

Procurando processos ocultos ...

 

Procurando entradas auto inicializáveis ocultas ...

 

Procurando ficheiros/arquivos ocultos ...

 

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

 

**************************************************************************

 

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

 

device: opened successfully

user: MBR read successfully

called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spgv.sys >>UNKNOWN [0x89C06938]<<

kernel: MBR read successfully

detected MBR rootkit hooks:

\Driver\Disk -> CLASSPNP.SYS @ 0xba8ecf28

\Driver\ACPI -> ACPI.sys @ 0xba674cb8

\Driver\atapi -> atapi.sys @ 0xba609b40

IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8

ParseProcedure -> ntkrnlpa.exe @ 0x805827e8

\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8

ParseProcedure -> ntkrnlpa.exe @ 0x805827e8

NDIS: IC Plus IP100 10/100 Fast Ethernet Adapter -> SendCompleteHandler -> NDIS.sys @ 0xba513bd4

PacketIndicateHandler -> NDIS.sys @ 0xba51fa21

SendHandler -> NDIS.sys @ 0xba513d44

user & kernel MBR OK

 

**************************************************************************

 

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]

"ImagePath"="d:\windows\system32\GameMon.des -service"

.

------------------------ Outros Processos em Execução ------------------------

.

d:\windows\system32\nvsvc32.exe

d:\windows\system32\wdfmgr.exe

d:\windows\system32\RUNDLL32.EXE

d:\arquivos de programas\Skype\Plugin Manager\skypePM.exe

d:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Tempo para conclusão: 2010-05-07 18:24:26 - Máquina reiniciou

ComboFix-quarantined-files.txt 2010-05-07 22:24

 

Pré-execução: 8 pasta(s) 50.443.902.976 bytes disponíveis

Pós execução: 9 pasta(s) 51.138.359.296 bytes disponíveis

 

WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

 

- - End Of File - - B775372C29C374B5F45F00447AF37479

[wings 22]

*Baixe o MBR e salve-o em C:\

*Clique em Iniciar > Executar > digite: c:\mbr.exe -f

*Clique OK. Caso seja perguntado, permita que o programa seja executado. Ele abrirá e fechará rapidamente.

*Duplo clique em C:\mbr.exe

*Cole o relatório criado em C:\mbr.log

[M1NG4W 0]

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

 

device: opened successfully

user: MBR read successfully

kernel: MBR read successfully

user & kernel MBR OK

[wings 22]

*Clique em [iniciar] > [Executar] > digite: Combofix /uninstall

*Clique [OK]

 

 

*Clique em [Executar]

*Aguarde até surgir a mensagem: "ComboFix está desinstalado"

*Clique [OK]

 

 

Tente instalar um antivírus agora. Sugiro o AVIRA.

[M1NG4W 0]

*Clique em [iniciar] > [Executar] > digite: Combofix /uninstall

*Clique [OK]

 

 

*Clique em [Executar]

*Aguarde até surgir a mensagem: "ComboFix está desinstalado"

*Clique [OK]

 

 

Tente instalar um antivírus agora. Sugiro o AVIRA'>http://www.free-av.com/"]AVIRA.

 

Ainda não consigo instalar nenhum antivirus

help me plz

[wings 22]

1.

*Baixe o SalityKiller e salve-o no desktop

 

*Extraia o seu conteúdo para C:\

*Desative a Restauração do Sistema

 

Clique com o botão direito do mouse em Meu Computador > Propriedades > Restauração do Sistema > Desativar Restauração do Sistema > OK > Sim

 

*Este programa irá rodar em 2 janelas distintas ao mesmo tempo!!

 

*A primeira janela:

*Clique em [iniciar] > [Executar] > copie e cole: C:\salitykiller.exe -m

*Clique [OK]

 

*Mantenha a janela rodando. Não feche-a!! Se desejar, minimize-a.

 

*A segunda janela:

*Clique em [iniciar] > [Executar] > copie e cole: C:\salitykiller.exe -y -x -j -l sality.txt -v

*Clique [OK]

*Ao término, a janela 2 será fechada automaticamente. Feche, então, a janela 1.

*Cole o resumo localizado no final do arquivo C:\sality.txt, conforme mostrado abaixo:

 

23:57:51:0 Infected files: 8

23:57:51:0 Infected processes: 0

23:57:51:0 Infected threads: 2

23:57:51:0 Cured files: 8

23:57:51:0 Executed registry scripts: 1

[Mário Monteiro 179]

Tópico Arquivado

 

Como o autor não respondeu por mais de 30 dias, o tópico foi arquivado.

 

Caso você seja o autor do tópico e quer reabrir, envie uma mensagem privada para um moderador da área juntamente com o link para este tópico e explique o motivo da reabertura.