[Resolvido!] Computador reiniciando, MSN problemática, senhas rou

Francisco Bastos · Maio 28, 2010

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 12:01:44, on 28/5/2010

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\ARQUIV~1\GbPlugin\GbpSv.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe

C:\Arquivos de programas\D-Tools\daemon.exe

C:\WINDOWS\VM30xSnap.exe

C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Arquivos de programas\Bonjour\mDNSResponder.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

c:\Arquivos de programas\Arquivos comuns\Protexis\License Service\PsiService_2.exe

C:\Arquivos de programas\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\Arquivos de programas\Microsoft ActiveSync\wcescomm.exe

C:\Documents and Settings\Bastos\Configurações locais\Dados de aplicativos\Google\Update\1.2.183.23\GoogleCrashHandler.exe

C:\Arquivos de programas\DNA\btdna.exe

C:\ARQUIV~1\MICROS~3\rapimgr.exe

C:\Arquivos de programas\Palm\Hotsync.exe

C:\Arquivos de programas\PDFCreator\PDFCreator.exe

C:\Arquivos de programas\BrOffice.org 2.2\program\soffice.exe

C:\Arquivos de programas\iPod\bin\iPodService.exe

C:\Arquivos de programas\BrOffice.org 2.2\program\soffice.BIN

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Arquivos de programas\Styler\Styler.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Java\jre6\bin\jucheck.exe

C:\Documents and Settings\Bastos\Desktop\HiJackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: CompSegIB - {2E3C3651-B19C-4DD9-A979-901EC3E930AF} - C:\Arquivos de programas\Scpad\scpsssh2.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\ARQUIV~1\GBPLUGIN\gbieh.dll

O2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\Arquivos de programas\GbPlugin\gbiehcef.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Arquivos de programas\Styler\TB\StylerTB.dll

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Arquivos de programas\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe

O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Arquivos de programas\D-Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [VM30xSnap] VM30xSnap.exe Vimicro USB PC Camera (ZC030x)

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [TkBellExe] "C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [HotSync] "C:\Program Files\PalmSource\Desktop\HotSync.exe" -AllUsers

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Bastos\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Arquivos de programas\Microsoft ActiveSync\wcescomm.exe"

O4 - HKCU\..\Run: [bitTorrent DNA] "C:\Arquivos de programas\DNA\btdna.exe"

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: BrOffice.org 2.2.lnk = C:\Arquivos de programas\BrOffice.org 2.2\program\quickstart.exe

O4 - Startup: PowerToChange.lnk = C:\Arquivos de programas\PowerToChange\PowerToChange.exe

O4 - Startup: Styler.lnk = ?

O4 - Global Startup: Hotsync Manager.lnk = C:\Arquivos de programas\Palm\Hotsync.exe

O4 - Global Startup: PDFCreator.lnk = C:\Arquivos de programas\PDFCreator\PDFCreator.exe

O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Arquivos de programas\MP3 Player Utilities 3.70\AMVConverter\grab.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Arquivos de programas\MP3 Player Utilities 3.70\MediaManager\grab.html

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\ARQUIV~1\MICROS~3\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\ARQUIV~1\MICROS~3\INetRepl.dll

O9 - Extra 'Tools' menuitem: Criar Favorito Móvel... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\ARQUIV~1\MICROS~3\INetRepl.dll

O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O15 - Trusted Zone: http://asia.msi.com.tw

O15 - Trusted Zone: http://global.msi.com.tw

O15 - Trusted Zone: http://www.msi.com.tw

O16 - DPF: {051D0E35-F4E3-4C8D-B411-AB0875F4C683} (Anark Client 4.0 ActiveX Control) - http://install.anark.com/client/version4/windows-ie/en/AMClient.cab

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/PT-BR/a-UNO1/GAME_UNO1.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1205652661781

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1205653159890

O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} (GbpDistObj Class) - https://www14.bancobrasil.com.br/plugin/GbpDist.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: GbPluginBb - C:\ARQUIV~1\GBPLUGIN\gbieh.dll

O20 - Winlogon Notify: GbPluginCef - C:\Arquivos de programas\GbPlugin\gbiehcef.dll

O21 - SSODL: CompIBBrd - {A3717295-941D-416F-9384-ED1736729F1C} - C:\Arquivos de programas\Scpad\scpLIB.dll

O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Daemon de cache de categorias de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: scpLIB - {A3717295-941D-416F-9384-ED1736729F1C} - C:\Arquivos de programas\Scpad\scpLIB.dll

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Arquivos de programas\Ares\chatServer.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Arquivos de programas\Bonjour\mDNSResponder.exe

O23 - Service: Gbp Service (GbpSv) - - C:\ARQUIV~1\GbPlugin\GbpSv.exe

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Arquivos de programas\Google\Update\GoogleUpdate.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Serviço iPod (iPod Service) - Apple Inc. - C:\Arquivos de programas\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe

O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB6p5\webserver\bin\win32\matlabserver.exe

O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Arquivos de programas\Arquivos comuns\Protexis\License Service\PsiService_2.exe

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Arquivos de programas\WinPcap\rpcapd.exe

--

End of file - 13391 bytes

DigRam · Maio 31, 2010

Bom Dia! Francisco Bastos

<@> Baixe: < > ( ...by sUBs )

<@> Salve-o no desktop!

<@> Desabilite as proteções residente de: antivírus,antispywares e firewall. ( Menos o do Windows! )

<@> Feche todas as janelas e execute a ferramenta!

<@> Ps: A execução,por comando,também é possível:
<@> Vá em Iniciar --> Executar --> Digite ou cole: "%userprofile%\Desktop\Combofix.exe" /killall

<@> Clique em Ok.

<@> Na janela: "Contrato de garantia de software" --> Clique em Sim!

<@> Não possuindo o "Console de Recuperação",aceite optar pela instalação do mesmo!

<!> Caso aconteça a notificação de: Aplicativo Win32 inválido,delete a ferramenta ComboFix.exe e faça,novamente,seu download.
<!> Salve-a no desktop,renomeada como: Kombo.exe

<!> Ps: Nomeie durante o salvamento,e não após salvá-la!

<!> Ps: Surgindo alguma mensagem de erro,rode o ComboFix.exe em "Modo de Segurança". <-- Link!

<!> Ps: Na presença de atividades rootkit,teremos a seguinte janela de notificação:

<!> Ps: Para completar as remoções,talvez haja necessidade da ferramenta reiniciar o computador. <-- Aguarde!

<!> Ps: Evite executar,voluntariamente,esta ferramenta!

<!> Ps: Para evitar problemas,siga todas as recomendações propostas.

<!> Ps: O ComboFix é uma ferramenta que pode danificar o sistema. Utilize-o,somente,sob supervisão profissional.

<@> Abrir-se-á a janela Auto Scan. --> Aguarde!

<@> Àfim de completar as remoções,o ComboFix poderá reiniciar o computador.

<@> Se houver necessidade,digite a opção para continuar! --> ( 1 ) --> Aperte Enter! --> Aguarde a conclusão!

<@> Durante o scan,evite manusear o mouse ou teclado! <-- Importante!

<@> Para parar ou sair do ComboFix,tecle "N" ou "2" --> Aperte Enter!

<@> Terminando,poste os relatórios: C:\ComboFix.txt + HijackThis,atualizado.

Abraços!

Francisco Bastos · Maio 31, 2010

Muito obrigado pela atenção.

Quando fui executar o ComboFix, ele realmente reiniciou o computador (encontrou o kitALGUMAcoisa); contudo, depois de reiniciar e executar várias etapas, no momento em que estava deletando vários arquivos, o computador reiniciou =/

Daí, entrei pelo modo de segurança e repeti o processo, dessa vez com êxito.

Olhando o log do ComboFix, vi que ele continou a remoção a partir desse arquivo: _008142_.tmp.dll. Antes do computador reiniciar, eu vi que ele tinha começado a deletar a partir do _008001_.tmp.dll, se não me falha a memória.

Enfim, segue o log do ComboFix e, em seguida, o novo logo do hijackthis.

Obrigado.

============

ComboFix 10-05-30.08 - Bastos 31/05/2010 10:28:35.3.2 - x86 NETWORK

Microsoft Windows XP Professional 5.1.2600.2.1252.55.1046.18.2039.1755 [GMT -3:00]

Executando de: C:\Documents and Settings\Bastos\Desktop\Kombo.exe

.

ADS - drivers: deleted 304 bytes in 1 streams.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Arquivos de programas\videosoft

C:\WINDOWS\system32\_008142_.tmp.dll

C:\WINDOWS\system32\_008143_.tmp.dll

C:\WINDOWS\system32\_008144_.tmp.dll

C:\WINDOWS\system32\_008145_.tmp.dll

C:\WINDOWS\system32\_008146_.tmp.dll

C:\WINDOWS\system32\_008147_.tmp.dll

C:\WINDOWS\system32\_008148_.tmp.dll

C:\WINDOWS\system32\_008149_.tmp.dll

C:\WINDOWS\system32\_008150_.tmp.dll

C:\WINDOWS\system32\_008151_.tmp.dll

C:\WINDOWS\system32\_008153_.tmp.dll

C:\WINDOWS\system32\_008154_.tmp.dll

C:\WINDOWS\system32\_008155_.tmp.dll

C:\WINDOWS\system32\_008157_.tmp.dll

C:\WINDOWS\system32\_008159_.tmp.dll

C:\WINDOWS\system32\_008160_.tmp.dll

C:\WINDOWS\system32\_008163_.tmp.dll

C:\WINDOWS\system32\_008166_.tmp.dll

C:\WINDOWS\system32\_008167_.tmp.dll

C:\WINDOWS\system32\_008172_.tmp.dll

C:\WINDOWS\system32\_008174_.tmp.dll

C:\WINDOWS\system32\_008177_.tmp.dll

C:\WINDOWS\system32\_008180_.tmp.dll

C:\WINDOWS\system32\_008181_.tmp.dll

C:\WINDOWS\system32\_008182_.tmp.dll

C:\WINDOWS\system32\_008185_.tmp.dll

C:\WINDOWS\system32\_008186_.tmp.dll

C:\WINDOWS\system32\_008187_.tmp.dll

C:\WINDOWS\system32\_008188_.tmp.dll

C:\WINDOWS\system32\_008189_.tmp.dll

C:\WINDOWS\system32\_008194_.tmp.dll

.

(((((((((((((((( Arquivos/Ficheiros criados de 2010-04-28 to 2010-05-31 ))))))))))))))))))))))))))))

.

2010-05-24 11:11:30 . 2010-05-24 11:11:30 503808 ----a-w- C:\Documents and Settings\Bastos\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\46\f84c6ae-18a984ef-n\msvcp71.dll

2010-05-24 11:11:30 . 2010-05-24 11:11:30 499712 ----a-w- C:\Documents and Settings\Bastos\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\46\f84c6ae-18a984ef-n\jmc.dll

2010-05-24 11:11:30 . 2010-05-24 11:11:30 348160 ----a-w- C:\Documents and Settings\Bastos\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\46\f84c6ae-18a984ef-n\msvcr71.dll

2010-05-17 15:45:28 . 2010-05-17 15:47:51 -------- d-----w- C:\LinhaDefensiva

2010-05-16 18:14:35 . 2010-05-16 18:14:35 -------- d-----w- C:\Arquivos de programas\DownloadToolz

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-05-31 13:08:57 . 2010-04-02 14:32:27 -------- d-----w- C:\Documents and Settings\Bastos\Dados de aplicativos\DNA

2010-05-31 13:04:23 . 2008-10-19 00:17:52 -------- d-----w- C:\Documents and Settings\Bastos\Dados de aplicativos\BrOffice.org2

2010-05-31 13:04:16 . 2010-04-02 14:32:27 -------- d-----w- C:\Arquivos de programas\DNA

2010-05-31 10:50:54 . 2008-03-16 06:32:56 -------- d-----w- C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin

2010-05-31 07:49:37 . 2008-03-28 22:32:13 -------- d-----w- C:\Documents and Settings\Bastos\Dados de aplicativos\uTorrent

2010-05-25 21:58:26 . 2010-03-14 04:38:07 -------- d-----w- C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft Help

2010-05-12 23:47:08 . 2008-06-03 17:13:51 -------- d-----w- C:\Documents and Settings\Bastos\Dados de aplicativos\gtk-2.0

2010-05-07 21:35:56 . 2008-03-16 06:32:56 -------- d-----w- C:\Arquivos de programas\GbPlugin

2010-04-30 12:18:34 . 2009-01-15 17:13:16 45472 ----a-w- C:\WINDOWS\system32\drivers\GbpKm.sys

2010-04-29 12:09:20 . 2010-04-29 12:06:24 -------- d-----w- C:\Arquivos de programas\Styler

2010-04-29 12:09:19 . 2010-04-29 12:09:19 -------- d-----w- C:\Documents and Settings\Bastos\Dados de aplicativos\Styler

2010-04-29 12:06:25 . 2010-04-29 12:06:25 15086 ----a-r- C:\Documents and Settings\Bastos\Dados de aplicativos\Microsoft\Installer\{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}\_7b12541d.exe

2010-04-29 12:06:25 . 2010-04-29 12:06:25 15086 ----a-r- C:\Documents and Settings\Bastos\Dados de aplicativos\Microsoft\Installer\{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}\_585b207a.exe

2010-04-24 12:36:54 . 2009-04-04 09:16:37 190 ----a-w- C:\Documents and Settings\All Users\Dados de aplicativos\SafeNet Sentinel\Sentinel RMS Development Kit\System\prsgrc.dll

2010-04-18 10:31:57 . 2010-04-18 10:31:57 -------- d-----w- C:\Arquivos de programas\Programas RFB

2010-04-08 21:30:51 . 2010-03-31 00:17:36 -------- d-----w- C:\Arquivos de programas\MegaJogos

2010-03-11 18:22:10 . 2010-04-18 10:31:57 69632 ----a-w- C:\WINDOWS\system32\MSJCE.dll

2010-03-07 21:58:05 . 2001-10-28 15:07:18 67232 ----a-w- C:\WINDOWS\system32\perfc016.dat

2010-03-07 21:58:05 . 2001-10-28 15:07:18 425072 ----a-w- C:\WINDOWS\system32\perfh016.dat

2001-05-24 15:59:30 . 2010-03-06 17:47:10 162304 ----a-w- C:\Arquivos de programas\UNWISE.EXE

2006-05-03 10:06:54 . 2008-09-14 18:25:58 163328 --sha-r- C:\WINDOWS\system32\flvDX.dll

2007-02-21 11:47:16 . 2008-09-14 18:25:59 31232 -csha-r- C:\WINDOWS\system32\msfDX.dll

2007-12-17 13:43:00 . 2008-09-14 18:26:01 27648 -csha-w- C:\WINDOWS\system32\Smab0.dll

2008-02-04 19:26:34 . 2008-09-14 18:26:01 151040 -csha-w- C:\WINDOWS\system32\VistaUltm.dll

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Google Update"="C:\Documents and Settings\Bastos\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe" [2008-09-23 16:40:45 133104]

"BitTorrent DNA"="C:\Arquivos de programas\DNA\btdna.exe" [2010-04-02 14:32:27 323392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"VM30xSnap"="VM30xSnap.exe Vimicro USB PC Camera (ZC030x)" [X]

"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 01:32:00 208952]

"QuickTime Task"="C:\Arquivos de programas\QuickTime\qttask.exe" [2008-02-01 02:13:08 385024]

"iTunesHelper"="C:\Arquivos de programas\iTunes\iTunesHelper.exe" [2008-02-19 16:10:32 267048]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 13:50:42 155648]

"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2003-05-16 06:01:54 188416]

"DAEMON Tools-1033"="C:\Arquivos de programas\D-Tools\daemon.exe" [2004-08-22 20:05:02 81920]

"Adobe Reader Speed Launcher"="C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 04:04:34 39792]

"TkBellExe"="C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" [2009-04-01 15:53:54 198160]

"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2008-02-15 15:46:46 135168]

"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2008-02-15 15:46:46 159744]

"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2008-02-15 15:46:18 131072]

"RTHDCPL"="RTHDCPL.EXE" [2009-03-12 20:21:00 17531392]

"SkyTel"="SkyTel.EXE" [2007-11-20 21:15:58 1826816]

"SunJavaUpdateSched"="C:\Arquivos de programas\Java\jre6\bin\jusched.exe" [2009-10-11 07:17:36 149280]

"GrooveMonitor"="C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 10:00:48 33648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"GbPluginBb"="C:\ARQUIV~1\GBPLUGIN\gbieh.dll" [2010-04-30 12:18:20 328992]

"GbPluginCef"="C:\ARQUIV~1\GbPlugin\gbiehCef.dll" [2010-04-23 18:27:34 315432]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 03:45:32 15360]

C:\Documents and Settings\Bastos\Menu Iniciar\Programas\Inicializar\

BrOffice.org 2.2.lnk - C:\Arquivos de programas\BrOffice.org 2.2\program\quickstart.exe [2007-3-31 393216]

C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\

Hotsync Manager.lnk - C:\Arquivos de programas\Palm\Hotsync.exe [2008-1-3 1392640]

PDFCreator.lnk - C:\Arquivos de programas\PDFCreator\PDFCreator.exe [2009-11-5 2641920]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{E37CB5F0-51F5-4395-A808-5FA49E399003}"= "C:\Arquivos de programas\GbPlugin\gbiehcef.dll" [2010-04-23 18:27:34 315432]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginBb]

2010-04-30 12:18:20 328992 ----a-w- C:\ARQUIV~1\GbPlugin\gbieh.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginCef]

2010-04-23 18:27:34 315432 ------w- C:\Arquivos de programas\GbPlugin\gbiehcef.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0sprestrt\0sprestrt

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Arquivos de programas\\Bonjour\\mDNSResponder.exe"=

"C:\\Arquivos de programas\\iTunes\\iTunes.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Arquivos de programas\\JustVoip.com\\JustVoip\\JustVoip.exe"=

"C:\\Arquivos de programas\\uTorrent\\uTorrent.exe"=

"C:\\Arquivos de programas\\Ares\\Ares.exe"=

"C:\\Arquivos de programas\\Megacubo\\megacubo.exe"=

"C:\\Arquivos de programas\\Megacubo\\bin\\minifly.exe"=

"C:\\Arquivos de programas\\gnucash\\bin\\gnucash-bin.exe"=

"C:\\Arquivos de programas\\gnucash\\bin\\gconfd-2.exe"=

"C:\\Arquivos de programas\\SPSSInc\\SPSS16\\spss.exe"=

"C:\\Arquivos de programas\\SPSSInc\\SPSS16\\spss.com"=

"C:\Arquivos de programas\Microsoft ActiveSync\rapimgr.exe"= C:\Arquivos de programas\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager

"C:\Arquivos de programas\Microsoft ActiveSync\wcescomm.exe"= C:\Arquivos de programas\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager

"C:\Arquivos de programas\Microsoft ActiveSync\WCESMgr.exe"= C:\Arquivos de programas\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

"C:\\Arquivos de programas\\Skype\\Plugin Manager\\skypePM.exe"=

"C:\\Arquivos de programas\\Skype\\Phone\\Skype.exe"=

"C:\\Arquivos de programas\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"C:\\Arquivos de programas\\Microsoft Office\\Office12\\GROOVE.EXE"=

"C:\\Arquivos de programas\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"C:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"=

"C:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Arquivos de programas\\DNA\\btdna.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 d347bus;d347bus;C:\WINDOWS\system32\drivers\d347bus.sys [29/3/2008 08:21:57 155136]

R0 d347prt;d347prt;C:\WINDOWS\system32\drivers\d347prt.sys [29/3/2008 08:21:57 5248]

R0 GbpKm;Gbp KernelMode;C:\WINDOWS\system32\drivers\GbpKm.sys [15/1/2009 14:13:16 45472]

S2 GbpSv;Gbp Service;C:\ARQUIV~1\GbPlugin\GbpSv.exe [16/3/2008 03:33:09 55072]

S2 gupdate;Google Update Service (gupdate);C:\Arquivos de programas\Google\Update\GoogleUpdate.exe [2/8/2009 21:55:26 133104]

S3 Ambfilt;Ambfilt;C:\WINDOWS\system32\drivers\Ambfilt.sys [24/7/2009 16:38:00 1684736]

S3 EverestDriver;Lavalys EVEREST Kernel Driver;C:\Arquivos de programas\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [20/7/2009 16:22:44 26736]

S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [6/11/2007 17:22:06 34064]

S3 VM30xx86;Vimicro USB PC Camera (ZC0301);C:\WINDOWS\system32\drivers\vm30xx86.sys [13/1/2009 19:05:15 1294464]

.

Conteúdo da pasta 'Tarefas Agendadas'

2010-05-31 C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

- C:\Arquivos de programas\Google\Update\GoogleUpdate.exe [2009-08-03 00:55:26 . 2009-08-03 00:55:23]

2010-05-31 C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

- C:\Arquivos de programas\Google\Update\GoogleUpdate.exe [2009-08-03 00:55:26 . 2009-08-03 00:55:23]

2010-05-31 C:\WINDOWS\Tasks\User_Feed_Synchronization-{F341D0DF-99C3-4C63-B66C-635BCB9505D9}.job

- C:\WINDOWS\system32\msfeedssync.exe [2007-08-13 21:36:40 . 2009-03-08 07:31:54]

.

------- Scan Suplementar -------

.

uStart Page = about:blank

IE: Add to AMV Convert Tool... - C:\Arquivos de programas\MP3 Player Utilities 3.70\AMVConverter\grab.html

IE: E&xport to Microsoft Excel - C:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: E&xportar para o Microsoft Excel - C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: MediaManager tool grab multimedia file - C:\Arquivos de programas\MP3 Player Utilities 3.70\MediaManager\grab.html

Trusted Zone: com.tw\asia.msi

Trusted Zone: com.tw\global.msi

Trusted Zone: com.tw\www.msi

DPF: {051D0E35-F4E3-4C8D-B411-AB0875F4C683} - hxxp://install.anark.com/client/version4/windows-ie/en/AMClient.cab

DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab

DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} - hxxps://www14.bancobrasil.com.br/plugin/GbpDist.cab

FF - ProfilePath - C:\Documents and Settings\Bastos\Dados de aplicativos\Mozilla\Firefox\Profiles\owgbm01i.default\

FF - prefs.js: browser.startup.homepage - about:blank

FF - component: C:\Documents and Settings\Bastos\Dados de aplicativos\Mozilla\Firefox\Profiles\owgbm01i.default\extensions\{87F8774F-B485-47E2-A755-A40A8A5E886C}\components\GbMzhBb.dll

FF - plugin: C:\ARQUIV~1\Palm\PACKAG~1\NPInstal.dll

FF - plugin: C:\Arquivos de programas\Google\Google Earth\plugin\npgeplugin.dll

FF - plugin: C:\Arquivos de programas\Google\Update\1.2.183.23\npGoogleOneClick8.dll

FF - plugin: C:\Arquivos de programas\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: C:\Arquivos de programas\Unity\WebPlayer\loader\npUnity3D32.dll

FF - plugin: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll

FF - plugin: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll

FF - plugin: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll

---- FIREFOX POLICIES ----

C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

C:\Arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

C:\Arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);

C:\Arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

C:\Arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

C:\Arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

.

------- Associação de arquivos/ficheiros -------

.

.scr=RasWin.Script

.

- - - - ORFÃOS REMOVIDOS - - - -

HKLM-Run-HotSync - C:\Program Files\PalmSource\Desktop\HotSync.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-05-31 10:35:26

Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]

"ImagePath"="\??\C:\Arquivos de programas\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"

.

--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\•€|ÿÿÿÿ"•€|þ»Òw*]

"6140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'winlogon.exe'(688)

C:\ARQUIV~1\GBPLUGIN\gbieh.dll

C:\Arquivos de programas\GbPlugin\gbiehcef.dll

.

Tempo para conclusão: 2010-05-31 10:36:40

ComboFix-quarantined-files.txt 2010-05-31 13:36:23

Pré-execução: 21 pasta(s) 49.737.490.432 bytes disponíveis

Pós execução: 24 pasta(s) 49.816.809.472 bytes disponíveis

- - End Of File - - 68B8899CECBBD609C8DCF6B2BFADF467

============================

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 11:04:25, on 31/5/2010

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Safe mode with network support

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\explorer.exe