[Arquivado] &nbspMsn, eh entradas USB

Juniorlopes · Setembro 9, 2010

ae pessoal to prescisando de uma maozinha, minhas USB'S nao estao funcionando, pois eu acho q e virus, eh meu MSN fica mandando menssagens com link's de virus, ae vai meu log.

Logfile of HijackThis v1.99.1

Scan saved at 20:06:15, on 9/9/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Running processes:

E:\WINDOWS\System32\smss.exe

E:\WINDOWS\system32\csrss.exe

E:\WINDOWS\system32\winlogon.exe

E:\WINDOWS\system32\services.exe

E:\WINDOWS\system32\lsass.exe

E:\WINDOWS\system32\svchost.exe

E:\WINDOWS\System32\svchost.exe

E:\WINDOWS\system32\svchost.exe

E:\Arquivos de programas\AVG\AVG9\avgchsvx.exe

E:\Arquivos de programas\AVG\AVG9\avgrsx.exe

E:\Arquivos de programas\AVG\AVG9\avgcsrvx.exe

E:\WINDOWS\system32\spoolsv.exe

E:\WINDOWS\system32\svchost.exe

E:\Arquivos de programas\AVG\AVG9\avgwdsvc.exe

E:\Arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

E:\Arquivos de programas\Spyware Terminator\sp_rsser.exe

E:\WINDOWS\system32\svchost.exe

E:\WINDOWS\system32\ctfmon.exe

E:\Arquivos de programas\Ares\Ares.exe

E:\Arquivos de programas\NitroPC\NitroPC.exe

E:\Documents and Settings\Júnior\Dados de aplicativos\HEX-5823-6893-6818\jutched.exe

E:\Arquivos de programas\NitroPC\NitroPCService.exe

E:\Arquivos de programas\Arquivos comuns\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe

E:\WINDOWS\explorer.exe

E:\Arquivos de programas\Messenger\msmsgs.exe

E:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

E:\Arquivos de programas\Windows Live\Contacts\wlcomm.exe

E:\Arquivos de programas\Google\Chrome\Application\chrome.exe

E:\WINDOWS\system32\wuauclt.exe

E:\Arquivos de programas\Google\Chrome\Application\chrome.exe

E:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60347

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.localstrike.com.ar/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.localstrike.com.ar/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60347

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60347

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60347

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60347

R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - E:\ARQUIV~1\Crawler\Toolbar\ctbr.dll

O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - E:\ARQUIV~1\Crawler\Toolbar\ctbr.dll

O2 - BHO: (no name) - {2F13335D-E80A-4BF3-93CF-A10899CA66CA} - e:\windows\system32\dlo9f.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - E:\Arquivos de programas\AVG\AVG9\avgssie.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - E:\Arquivos de programas\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - E:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - E:\Arquivos de programas\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - E:\Arquivos de programas\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: Barra de Ferramentas &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - E:\ARQUIV~1\Crawler\Toolbar\ctbr.dll

O4 - HKLM\..\Run: [AVG9_TRAY] E:\ARQUIV~1\AVG\AVG9\avgtray.exe

O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "E:\Arquivos de programas\Arquivos comuns\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"

O4 - HKLM\..\Run: [switchBoard] E:\Arquivos de programas\Arquivos comuns\Adobe\SwitchBoard\SwitchBoard.exe

O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "E:\Arquivos de programas\Arquivos comuns\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin

O4 - HKLM\..\Run: [spywareTerminator] "E:\Arquivos de programas\Spyware Terminator\SpywareTerminatorShield.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [ares] "E:\Arquivos de programas\Ares\Ares.exe" -h

O4 - HKCU\..\Run: [msnmsgr] "E:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [NitroPC] "E:\Arquivos de programas\NitroPC\NitroPC.exe" -minimized

O4 - HKCU\..\Run: [Java Update Manager] E:\Documents and Settings\Júnior\Dados de aplicativos\HEX-5823-6893-6818\jutched.exe

O4 - HKCU\..\Run: [spywareTerminatorUpdate] "E:\Arquivos de programas\Spyware Terminator\SpywareTerminatorUpdate.exe"

O4 - HKCU\..\Run: [MSMSGS] "E:\Arquivos de programas\Messenger\msmsgs.exe" /background

O8 - Extra context menu item: Crawler Search - tbr:iemenu

O9 - Extra button: Incluir no Blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - E:\Arquivos de programas\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Incluir no Blog no Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - E:\Arquivos de programas\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Arquivos de programas\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {4A85DBE0-BFB2-4119-8401-186A7C6EB653} - http://messenger.zone.msn.com/MessengerGamesContent/GameContent/pt/mjss/MJSS.cab109791.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/MessengerGamesContent/GameContent/pt/uno1/GAME_UNO1.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1282940782875

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - E:\Arquivos de programas\AVG\AVG9\avgpp.dll

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - E:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - E:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - E:\ARQUIV~1\Crawler\Toolbar\ctbr.dll

O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - E:\Arquivos de programas\Windows Live\Mail\mailcomm.dll

O20 - Winlogon Notify: avgrsstarter - E:\WINDOWS\SYSTEM32\avgrsstx.dll

O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - E:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - E:\Arquivos de programas\AVG\AVG9\avgemc.exe

O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - E:\Arquivos de programas\AVG\AVG9\avgwdsvc.exe

O23 - Service: Google Update Service (gupdate) (gupdate) - Unknown owner - E:\Arquivos de programas\Google\Update\GoogleUpdate.exe" /svc (file missing)

O23 - Service: Windows CardSpace (idsvc) - Unknown owner - E:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (file missing)

O23 - Service: NitroPC Service (NitroPCSrv) - Intelliclick Informática - E:\Arquivos de programas\NitroPC\NitroPCService.exe

O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - E:\Arquivos de programas\Spyware Terminator\sp_rsser.exe

O23 - Service: Adobe SwitchBoard (SwitchBoard) - Adobe Systems Incorporated - E:\Arquivos de programas\Arquivos comuns\Adobe\SwitchBoard\SwitchBoard.exe

Felipe_88 · Setembro 9, 2010

Boa Noite Juniorlopes! Seja Bem Vindo ao Fórum iMasters!

1º

*Abra o Windows explorer

*Conecte o pen drive no PC e mantenha a tecla [shift] apertada até que o pen drive seja reconhecido.

3.

*Desative temporariamente seu antivírus

*Baixe o USBFix'>http://chiquitine.changelog.fr/UsbFix.exe"]USBFix e salve-o no desktop

*Execute o UsbFix

*Clique em [Pesquisa] e aguarde o término

*Remova o Pendrive

*Cole o relatório criado em C:\UsbFix.txt

No aguardo!

Juniorlopes · Setembro 10, 2010

eu abro o windows explorer, e conecto o pen driver e fico prescionando shift, mas nao acontece nada ;/

o link nao esta funcionando tb.

aparece: Multiple Choices

The document name you requested (/UsbFix.exeâ€]) could not be found on this server. However, we found documents with names similar to the one you requested.

Available documents:

/UsbFix.exe (common basename)

Please consider informing the owner of the referring page about the broken link.

Juniorlopes · Setembro 10, 2010

############################## | UsbFix 7.024 | [Pesquisa]

Usuário: Júnior (Administrador) # JUNIOR [ ]

Atualizado em 09/09/10 por El Desaparecido / C_XX

Começou em 23:58:42 | 09/09/2010

Site: http://www.teamxscript.org

Contato: FindyKill.Contact@gmail.com

CPU: Intel® Pentium® 4 CPU 2.40GHz

Microsoft Windows XP Professional (5.1.2600 32-Bit) # Service Pack 3

Internet Explorer 8.0.6001.18702

Windows Firewall: Deficientes /!\

Antivirus: AVG Anti-Virus Free 9.0 [Enabled | Updated]

RAM -> 479 Mb

C:\ -> Disco fixo # 37 Gb (34 Mb livre - 93%) [] # NTFS

D:\ -> CD-ROM

E:\ (%systemdrive%) -> Disco fixo # 37 Gb (13 Mb livre - 36%) [] # NTFS

################## | Ficheiros # pastas infeciosos |

Presente ! E:\WINDOWS\system32\mnmsrvc.exe

Presente ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\adp.exe

Presente ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\hcl.exe

Presente ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\2247927.exe

Presente ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\3302749.exe

Presente ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\3406975.exe

Presente ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\4060799.exe

Presente ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\4773001.exe

Presente ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\6278184.exe

Presente ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\6477569.exe

Presente ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\7443990.exe

Presente ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\7475903.exe

Presente ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\7611617.exe

Presente ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\8439068.exe

Presente ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\8796212.exe

Presente ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\8922938.exe

Presente ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\8966654.exe

Presente ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\8999759.exe

Presente ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\9086931.exe

Presente ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\VWL18A.tmp

Presente ! E:\Arquivos de programas\Ares\chatServer.exe

Presente ! E:\Arquivos de programas\Arquivos comuns\Apple\Apple Application Support\defaults.exe

Presente ! E:\Arquivos de programas\Arquivos comuns\Apple\Apple Application Support\distnoted.exe

Presente ! E:\Arquivos de programas\Arquivos comuns\Apple\Apple Application Support\plutil.exe

Presente ! E:\Arquivos de programas\AVG\AVG9\avgcfgex.exe

Presente ! E:\Arquivos de programas\AVG\AVG9\avgdumpx.exe

Presente ! E:\Arquivos de programas\AVG\AVG9\avgiproxy.exe

Presente ! E:\Arquivos de programas\AVG\AVG9\setup.exe

Presente ! E:\Arquivos de programas\Google\Chrome\Application\4.1.249.1036\Installer\setup.exe

Presente ! E:\Arquivos de programas\Real\RealPlayer\converter\RealTrimmer.exe

Presente ! E:\Arquivos de programas\Windows NT\hypertrm.exe

Presente ! E:\Arquivos de programas\WinRAR\Rar.exe

Presente ! E:\Arquivos de programas\WinRAR\RarExtLoader.exe

Presente ! E:\Arquivos de programas\WinRAR\UnRAR.exe

Presente ! E:\Documents and Settings\All Users\Dados de aplicativos\Apple Computer\Installer Cache\Safari 5.33.17.8\SetupAdmin.exe

Presente ! E:\Documents and Settings\Júnior\Configurações locais\Temp\0115696.exe

Presente ! E:\Documents and Settings\Júnior\Configurações locais\Temp\0465392.exe

Presente ! E:\Documents and Settings\Júnior\Configurações locais\Temp\2247927.exe

Presente ! E:\Documents and Settings\Júnior\Configurações locais\Temp\3302749.exe

Presente ! E:\Documents and Settings\Júnior\Configurações locais\Temp\4060799.exe

Presente ! E:\Documents and Settings\Júnior\Configurações locais\Temp\4773001.exe

Presente ! E:\Documents and Settings\Júnior\Configurações locais\Temp\6278184.exe

Presente ! E:\Documents and Settings\Júnior\Configurações locais\Temp\6477569.exe

Presente ! E:\Documents and Settings\Júnior\Configurações locais\Temp\7443990.exe

Presente ! E:\Documents and Settings\Júnior\Configurações locais\Temp\7475903.exe

Presente ! E:\Documents and Settings\Júnior\Configurações locais\Temp\7611617.exe

Presente ! E:\Documents and Settings\Júnior\Configurações locais\Temp\8439068.exe

Presente ! E:\Documents and Settings\Júnior\Configurações locais\Temp\8796212.exe

Presente ! E:\Documents and Settings\Júnior\Configurações locais\Temp\8922938.exe

Presente ! E:\Documents and Settings\Júnior\Configurações locais\Temp\8966654.exe

Presente ! E:\Documents and Settings\Júnior\Configurações locais\Temp\8999759.exe

Presente ! E:\Documents and Settings\Júnior\Configurações locais\Temp\9086931.exe

Presente ! E:\Documents and Settings\Júnior\Configurações locais\Temp\cpst.exe

Presente ! E:\WINDOWS\ServicePackFiles\i386\mnmsrvc.exe

Presente ! E:\WINDOWS\system32\Macromed\Flash\FlashUtil10h_Plugin.exe

Presente ! E:\WINDOWS\system32\migpwd.exe

################## | Registro |

Presente ! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|Java Update Manager

################## | Mountpoints2 |

HKCU\.\.\.\.\Explorer\MountPoints2\{839acdc7-a03e-11df-ab76-0013d31bfaf0}

Shell\open\Command = F:\JUNIOR\JUNIOR\JUNIORx1o

HKCU\.\.\.\.\Explorer\MountPoints2\{839acdcb-a03e-11df-ab76-0013d31bfaf0}

Shell\autopLay\Command = H:\jmurgt.exe

Shell\AutoRun\Command = H:\jmurgt.exe

Shell\ExplorE\Command = H:\jmurgt.exe

Shell\open\Command = H:\jmurgt.exe

################## | Vaccin |

(!) Este computador não é vacinada!

################## | E.O.F |

Felipe_88 · Setembro 10, 2010

Juniorlopes,

*Conecte novamente o Pendrive no PC

*Execute o UsbFix

*Clique em [Supressão] e aguarde o término

*Remova o Pendrive

*Cole o relatório criado em C:\UsbFix.txt

Juniorlopes · Setembro 10, 2010

Fiz da forma q voce mandou fazer!

############################## | UsbFix 7.024 | [supressão]

Usuário: Júnior (Administrador) # JUNIOR [ ]

Atualizado em 09/09/10 por El Desaparecido / C_XX

Começou em 13:04:22 | 10/09/2010

Site: http://www.teamxscript.org

Contato: FindyKill.Contact@gmail.com

CPU: Intel® Pentium® 4 CPU 2.40GHz

Microsoft Windows XP Professional (5.1.2600 32-Bit) # Service Pack 3

Internet Explorer 8.0.6001.18702

Windows Firewall: Deficientes /!\

Antivirus: AVG Anti-Virus Free 9.0 [Enabled | Updated]

RAM -> 479 Mb

C:\ -> Disco fixo # 37 Gb (34 Mb livre - 93%) [] # NTFS

D:\ -> CD-ROM

E:\ (%systemdrive%) -> Disco fixo # 37 Gb (14 Mb livre - 37%) [] # NTFS

################## | Ficheiros # pastas infeciosos |

Supprimido ! E:\WINDOWS\system32\mnmsrvc.exe

Supprimido ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\adp.exe

Supprimido ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\hcl.exe

Supprimido ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\2247927.exe

Supprimido ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\3302749.exe

Supprimido ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\3406975.exe

Supprimido ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\4060799.exe

Supprimido ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\4773001.exe

Supprimido ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\6278184.exe

Supprimido ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\6477569.exe

Supprimido ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\7443990.exe

Supprimido ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\7475903.exe

Supprimido ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\7611617.exe

Supprimido ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\8439068.exe

Supprimido ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\8796212.exe

Supprimido ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\8922938.exe

Supprimido ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\8966654.exe

Supprimido ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\8999759.exe

Supprimido ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\9086931.exe

Supprimido ! E:\DOCUME~1\JNIOR~1\CONFIG~1\Temp\VWL18A.tmp

Supprimido ! E:\WINDOWS\ServicePackFiles\i386\mnmsrvc.exe

################## | Registro |

Supprimido ! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|Java Update Manager

################## | Mountpoints2 |

Supprimido ! HKCU\.\.\.\.\Explorer\MountPoints2\{839acdc7-a03e-11df-ab76-0013d31bfaf0}

Supprimido ! HKCU\.\.\.\.\Explorer\MountPoints2\{839acdcb-a03e-11df-ab76-0013d31bfaf0}

################## | Listing |

[05/08/2010 - 00:42:15 | HD ] C:\$AVG

[09/09/2010 - 18:06:51 | D ] C:\0230b833f19017c0d5f5c8

[05/08/2010 - 00:01:25 | A | 0] C:\AUTOEXEC.BAT

[09/09/2010 - 18:06:07 | D ] C:\b6cd5fa555a8c0ba566c3f2880ad68

[04/08/2010 - 23:54:50 | SH | 211] C:\boot.ini

[28/10/2001 - 14:06:10 | RASH | 4952] C:\Bootfont.bin

[08/09/2010 - 17:03:23 | D ] C:\ceb921c26c04818f664588bad381c2

[05/08/2010 - 00:01:25 | A | 0] C:\CONFIG.SYS

[06/08/2010 - 16:16:50 | D ] C:\CtDriverInstTemp

[28/08/2010 - 02:49:40 | D ] C:\f45b4e0cca497bde79785e6bd6

[05/09/2010 - 23:19:00 | D ] C:\fotos

[05/08/2010 - 00:01:25 | RASH | 0] C:\IO.SYS

[05/08/2010 - 00:01:25 | RASH | 0] C:\MSDOS.SYS

[04/09/2010 - 13:47:48 | D ] C:\Musicas

[04/09/2010 - 13:47:48 | D ] C:\My Shared Folder

[03/08/2004 - 22:38:34 | RASH | 47564] C:\NTDETECT.COM

[28/08/2010 - 08:59:05 | RASH | 251696] C:\ntldr

[19/08/2010 - 00:26:40 | D ] C:\PFiles

[13/08/2010 - 00:04:29 | D ] C:\Photoshop

[05/08/2010 - 01:52:21 | D ] C:\Program Files

[10/09/2010 - 13:12:55 | SHD ] C:\RECYCLER

[07/09/2010 - 09:21:18 | A | 1257] C:\sti.log

[09/09/2010 - 18:13:48 | SHD ] C:\System Volume Information

[06/08/2010 - 16:23:58 | D ] C:\WebCamNX

[06/08/2010 - 15:52:39 | D ] C:\WebcamProeX

[05/08/2010 - 00:43:24 | HD ] E:\$AVG

[08/09/2010 - 17:09:09 | RD ] E:\Arquivos de programas

[05/08/2010 - 00:06:56 | D ] E:\Documents and Settings

[08/09/2010 - 16:27:07 | ASH | 502845440] E:\hiberfil.sys

[10/09/2010 - 00:21:00 | D ] E:\HijackThis

[10/09/2010 - 13:05:13 | ASH | 1047527424] E:\pagefile.sys

[10/09/2010 - 13:12:55 | SHD ] E:\RECYCLER

[09/09/2010 - 19:42:14 | SHD ] E:\System Volume Information

[10/09/2010 - 13:13:10 | D ] E:\UsbFix

[10/09/2010 - 13:13:18 | A | 2083] E:\UsbFix.txt

[08/09/2010 - 17:01:36 | D ] E:\WINDOWS

################## | Vaccin |

C:\Autorun.inf -> Folder criado por UsbFix (El Desaparecido & C_XX)

E:\Autorun.inf -> Folder criado por UsbFix (El Desaparecido & C_XX)

################## | Upload |

Favor enviar o arquivo: E:\UsbFix_Upload_Me_JUNIOR.zip

http://chiquitine.changelog.fr/Sample/Upload.php

Obrigado pela sua contribuição.

################## | E.O.F |

Felipe_88 · Setembro 10, 2010

Juniorlopes

1º

Envie o arquivo: E:\UsbFix_Upload_Me_JUNIOR.zip

Para: http://chiquitine.changelog.fr/Sample/Upload.php

Obrigado pela sua contribuição.

2º

*Execute o UsbFix

*Clique [uninstall]

3º

*Baixe o MalwareBytes'>http://www.malwarebytes.org/mbam-download.php"]MalwareBytes Anti-Malware e salve-o no desktop

*Instale o programa

*Se alguma atualização existir,o download será automático. Aguarde...

*O programa será aberto automaticamente.

*Na aba [Verificação], selecione a opção [Verificação completa]

*Clique em [Verificar] e selecione as partições a serem examinadas (geralmente C:\ e D:\)

*Ao término do scan, poderá ser interrogado se deseja remover objetos da memória. Clique [sIM] > [OK] > [Mostrar Resultados]

*Clique em [Remover Selecionados]

*Um relatório (mbam-log-ano-mês-data.txt) será apresentado.

*Cole-o na sua próxima resposta

Juniorlopes · Setembro 11, 2010

Ei cara acho q o virus saiu ;]

mas so q o pc ficou lento dps q eu o reiniciei,o q fazer ?

la vai o log:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Versão da Base de Dados: 4591

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

11/9/2010 01:32:47

mbam-log-2010-09-11 (01-32-47).txt

Tipo de Verificação: Verificação Completa (C:\|E:\|)

Objetos escaneados: 165270

Tempo decorrido: 1 hora(s), 9 minuto(s), 58 segundo(s)

Processos de Memória Infectados: 0

Módulos de Memória Infectados: 0

Chaves de Registro Infectadas: 0

Valores de Registro Infectados: 0

Itens de Dados no Registro Infectados: 0

Pastas Infectadas: 1

Arquivos Infectados: 6

Processos de Memória Infectados: