[Arquivado] &nbspanalizem o meu log

[Dom Luiz 0]

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 12:38:16, on 15/8/2010

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\msiexec.exe

C:\WINDOWS\Explorer.exe

C:\WINDOWS\system32\csrcs.exe

C:\WINDOWS\system32\sshib.exe

C:\WINDOWS\system32\Helper.exe

C:\winnt_\winntR1.exe

C:\winnt_\winnt.exe

C:\WINDOWS\windowsmp.exe

C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe

C:\WINDOWS\system32\scpsssh.exe

C:\WINDOWS\system32\GbpSwin.exe

C:\WINDOWS\system32\GbpGSvcbj.exe

C:\WINDOWS\system32\GbPlugln.exe

C:\WINDOWS\system32\scpLIBB.exe

C:\WINDOWS\mpegrede.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\WINDOWS\system32\regsvr.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\taskmgr.exe

C:\DOCUME~1\ALBERT~1.CAS\CONFIG~1\Temp\Nsd.exe

C:\WINDOWS\Nlutaa.exe

C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE

C:\Documents and Settings\ALBERTO.CASA-0AB9224957\Desktop\HiJackThis.exe

C:\WINDOWS\system32\cmd.exe

C:\WINDOWS\system32\net.exe

 

F2 - REG:system.ini: Shell=Explorer.exe csrcs.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,,C:\WINDOWS\system32\init.exe,

O1 - Hosts: httpd.conf

O1 - Hosts: ==========

O1 - Hosts: NameVirtualHost *

O1 - Hosts: <VirtualHost *:80>

O1 - Hosts: ServerAdmin localhosts@localhosts

O1 - Hosts: DocumentRoot C:\wamp\www

O1 - Hosts: ServerName localhost

O1 - Hosts: ErrorLog logs/localhost-error_log

O1 - Hosts: CustomLog logs/localhost-access_log combined

O1 - Hosts: </VirtualHost>

O1 - Hosts: <VirtualHost *:80>

O1 - Hosts: ServerAdmin localhosts@localhosts

O1 - Hosts: DocumentRoot C:\wamp\www\uniclass

O1 - Hosts: ServerName www.itauuniclass.com.br

O1 - Hosts: ErrorLog logs/uniclass-error_log

O1 - Hosts: CustomLog logs/uniclass-access_log combined

O1 - Hosts: </VirtualHost>

O1 - Hosts: <VirtualHost *:80>

O1 - Hosts: ServerAdmin localhosts@localhosts

O1 - Hosts: DocumentRoot C:\wamp\www\personnalite

O1 - Hosts: ServerName www.itaupersonnalite.com.br

O1 - Hosts: ErrorLog logs/personnalite-error_log

O1 - Hosts: CustomLog logs/personnalite-access_log combined

O1 - Hosts: </VirtualHost>

O1 - Hosts: <VirtualHost *:80>

O1 - Hosts: ServerAdmin localhosts@localhosts

O1 - Hosts: DocumentRoot C:\wamp\www\itau

O1 - Hosts: ServerName www.itau.com.br

O1 - Hosts: ErrorLog logs/itau-error_log

O1 - Hosts: CustomLog logs/itau-access_log combined

O1 - Hosts: </VirtualHost>

O1 - Hosts: <VirtualHost *:80>

O1 - Hosts: ServerAdmin localhosts@localhosts

O1 - Hosts: DocumentRoot C:\wamp\www\HSBC

O1 - Hosts: ServerName www.hsbc.com.br

O1 - Hosts: ErrorLog logs/HSBC-error_log

O1 - Hosts: CustomLog logs/HSBC-access_log combined

O1 - Hosts: </VirtualHost>

O1 - Hosts: <VirtualHost *:80>

O1 - Hosts: ServerAdmin localhosts@localhosts

O1 - Hosts: DocumentRoot C:\wamp\www\visa

O1 - Hosts: ServerName www.visa.com.br

O1 - Hosts: ErrorLog logs/visa-error_log

O1 - Hosts: CustomLog logs/visa-access_log combined

O1 - Hosts: </VirtualHost>

O1 - Hosts: <VirtualHost *:80>

O1 - Hosts: ServerAdmin localhosts@localhosts

O1 - Hosts: DocumentRoot C:\wamp\www\visa

O1 - Hosts: ServerName www.promocoesvisa.com.br

O1 - Hosts: ErrorLog logs/visa-error_log

O1 - Hosts: CustomLog logs/visa-access_log combined

O1 - Hosts: </VirtualHost>

O1 - Hosts: <VirtualHost *:80>

O1 - Hosts: ServerAdmin localhosts@localhosts

O1 - Hosts: DocumentRoot C:\wamp\www\mastercard

O1 - Hosts: ServerName www.mastercard.com.br

O1 - Hosts: ErrorLog logs/mastercard-error_log

O1 - Hosts: CustomLog logs/mastercard-access_log combined

O1 - Hosts: </VirtualHost>

O1 - Hosts: <VirtualHost *:80>

O1 - Hosts: ServerAdmin localhosts@localhosts

O1 - Hosts: DocumentRoot C:\wamp\www\mastercard

O1 - Hosts: ServerName www.naotempreco.com.br

O1 - Hosts: ErrorLog logs/mastercard-error_log

O1 - Hosts: CustomLog logs/mastercard-access_log combined

O1 - Hosts: </VirtualHost>

O1 - Hosts: <VirtualHost *:80>

O1 - Hosts: ServerAdmin localhosts@localhosts

O1 - Hosts: DocumentRoot C:\wamp\www\mastercard

O1 - Hosts: ServerName www.surpreendamc.com.br

O1 - Hosts: ErrorLog logs/mastercard-error_log

O1 - Hosts: CustomLog logs/mastercard-access_log combined

O1 - Hosts: </VirtualHost>

O1 - Hosts: <VirtualHost *:80>

O1 - Hosts: ServerAdmin localhosts@localhosts

O1 - Hosts: DocumentRoot C:\wamp\www\mastercard

O1 - Hosts: ServerName www.mastercardpromocoes.com.br

O1 - Hosts: ErrorLog logs/mastercard-error_log

O1 - Hosts: CustomLog logs/mastercard-access_log combined

O1 - Hosts: </VirtualHost>

O1 - Hosts: <VirtualHost *:80>

O1 - Hosts: ServerAdmin localhosts@localhosts

O1 - Hosts: DocumentRoot C:\wamp\www\americanexpress

O1 - Hosts: ServerName www.americanexpress.com.br

O1 - Hosts: ErrorLog logs/americanexpress-error_log

O1 - Hosts: CustomLog logs/americanexpress-access_log combined

O1 - Hosts: </VirtualHost>

O1 - Hosts: hosts

O1 - Hosts: =====

O1 - Hosts: 187.45.235.29 localhost

O1 - Hosts: 187.45.235.29 www.itauuniclass.com.br

O1 - Hosts: 187.45.235.29 www.itaupersonnalite.com.br

O1 - Hosts: 187.45.235.29 www.itau.com.br

O1 - Hosts: 187.45.235.29 www.hsbc.com.br

O1 - Hosts: 187.45.235.29 www.visa.com.br

O1 - Hosts: 187.45.235.29 www.promocoesvisa.com.br

O1 - Hosts: 187.45.235.29 www.mastercard.com.br

O1 - Hosts: 187.45.235.29 www.naotempreco.com.br

O1 - Hosts: 187.45.235.29 www.surpreendamc.com.br

O1 - Hosts: 187.45.235.29 www.mastercardpromocoes.com.br

O1 - Hosts: 187.45.235.29 www.americanexpress.com.br

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: NP Helper Class - {35B8D58C-B0CB-46b0-BA64-05B3804E4E86} - C:\Arquivos de programas\Internet Saving Optimizer\3.8.1.4690\NPIEAddOn.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: System Search Dispatcher - {CDBFB47B-58A8-4111-BF95-06178DCE326D} - C:\Arquivos de programas\System Search Dispatcher\1.4.3.1040\ssd.dll (file missing)

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll (file missing)

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (file missing)

O4 - HKLM\..\Run: [system.Defense.ieGoldMax] C:\WINDOWS\system32\GbpSm.exe

O4 - HKLM\..\Run: [sshib] C:\WINDOWS\system32\sshib.exe

O4 - HKLM\..\Run: [Helper] C:\WINDOWS\system32\Helper.exe

O4 - HKLM\..\Run: [process] C:\WINDOWS\system32\process.exe

O4 - HKLM\..\Run: [winntR1] c:\winnt_\winntR1.exe

O4 - HKLM\..\Run: [winnt] c:\winnt_\winnt.exe

O4 - HKLM\..\Run: [windowsmp] C:\WINDOWS\windowsmp.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [scpsssh] C:\WINDOWS\system32\scpsssh.exe

O4 - HKLM\..\Run: [GbpSwin] C:\WINDOWS\system32\GbpSwin.exe

O4 - HKLM\..\Run: [gbiehs] C:\WINDOWS\system32\gbiehs.exe

O4 - HKLM\..\Run: [GbpGSvc] C:\WINDOWS\system32\GbpGSvcbj.exe

O4 - HKLM\..\Run: [GbPlugln] C:\WINDOWS\system32\GbPlugln.exe

O4 - HKLM\..\Run: [scpLIBB] C:\WINDOWS\system32\scpLIBB.exe

O4 - HKLM\..\Run: [install01] C:\WINDOWS\install01.exe

O4 - HKLM\..\Run: [GbpSm] C:\WINDOWS\GbpSm.exe

O4 - HKLM\..\Run: [mpegrede] C:\WINDOWS\mpegrede.exe

O4 - HKLM\..\Run: [shockwaveFlashupdates] C:\WINDOWS\ShockwaveFlashupdates.exe

O4 - HKLM\..\RunServices: [csrcs] C:\WINDOWS\system32\csrcs.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [sshib] C:\WINDOWS\system32\sshib.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [smileyApp] C:\Arquivos de programas\DoubleD\JuicyAccess Toolbar\4.2.7.25320\stbapp.exe

O4 - HKCU\..\Run: [swg] "C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [javasev.exe] C:\WINDOWS\system32\javasev.exe

O4 - HKCU\..\Run: [scpsssh] C:\WINDOWS\system32\scpsssh.exe

O4 - HKCU\..\Run: [scpLIBB] C:\WINDOWS\system32\scpLIBB.exe

O4 - HKCU\..\Run: [Msn Messsenger] C:\WINDOWS\system32\regsvr.exe

O4 - HKCU\..\Run: [install01] C:\WINDOWS\install01.exe

O4 - HKCU\..\Run: [GbpSm] C:\WINDOWS\GbpSm.exe

O4 - HKCU\..\Run: [mpegrede] C:\WINDOWS\mpegrede.exe

O4 - HKCU\..\Run: [ZE18MW23GY] C:\DOCUME~1\ALBERT~1.CAS\CONFIG~1\Temp\Nsd.exe

O4 - HKLM\..\Policies\Explorer\Run: [csrcs] C:\WINDOWS\system32\csrcs.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: LimeWire On Startup.lnk = C:\Arquivos de programas\LimeWire\LimeWire.exe

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

O8 - Extra context menu item: Google Sidewiki... - res://C:\Arquivos de programas\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O15 - Trusted Zone: http://institucionalcompleto.vilabol.uol.com.br

O15 - Trusted Zone: http://www.10001.kit.net

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1281885344531

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1281885613406

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{E06DAC35-60F1-4271-860D-B49AD3082C6C}: NameServer = 201.10.128.3,201.10.120.2

O17 - HKLM\System\CCS\Services\Tcpip\..\{FCD9D086-4D94-4C68-BEA4-9AE67A7B899B}: NameServer = 201.10.128.3,201.10.120.3

O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Daemon de cache de categorias de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

 

--

End of file - 11729 bytes

[wings 22]

Boa tarde....

 

1.

*Baixe oHostsXpert e salve-o no desktop

*Extraia para o desktop e execute-o.

*Clique em > [Restore Microsoft's Hosts File]

 

2.

*Baixe o MalwareBytes Anti-malware e salve-o no desktop

*Instale o programa

*Se alguma atualização existir, o download será automático. Aguarde...

*O programa será aberto automaticamente.

*Na aba [Verificação], selecione a opção [Verificação completa]

*Clique em [Verificar] e selecione as partições a serem examinadas (geralmente C:\ e D:\)

*Ao término do scan, poderá ser interrogado se deseja remover objetos da memória. Clique [sIM] > [OK] > [Mostrar Resultados]

*Clique em [Remover Selecionados]

*Um relatório (mbam-log-ano-mês-data.txt) será apresentado.

*Cole-o na sua próxima resposta

[Felipe_88 0]

Tópico Arquivado

 

Como o autor não respondeu por mais de 30 dias, o tópico foi arquivado.

 

Caso você seja o autor do tópico e quer reabrir, envie uma mensagem privada para um moderador da área juntamente com o link para este tópico e explique o motivo da reabertura.