[Resolvido] &nbspAnalise de Log!

GildazioJr · Agosto 9, 2011

Olá amigos, meu pc a um tempo vem ficando um pouco lento e agora passou a desligar por si só, gostaria se possivel da ajuda de voces, muito obrigado e um grande abraço!

Ai vai o log do hijackthis:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 09:59:35, on 09/08/2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\AVAST Software\Avast\afwServ.exe

C:\Arquivos de programas\AVAST Software\Avast\AvastSvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\IntraChat\CICServer.exe

C:\Arquivos de programas\Firebird\Firebird_2_1\bin\fbguard.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\Arquivos de programas\Keyboard Driver\KMWDSrv.exe

C:\Arquivos de programas\LogMeIn\x86\LMIGuardianSvc.exe

C:\Arquivos de programas\LogMeIn\x86\RaMaint.exe

C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe

C:\Arquivos de programas\Malwarebytes' Anti-Malware\mbamservice.exe

C:\MySQL\bin\mysqld-max.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\UltraVNC\WinVNC.exe

C:\Arquivos de programas\LogMeIn\x86\LogMeInSystray.exe

C:\Arquivos de programas\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Arquivos de programas\Keyboard Driver\StartAutorun.exe

C:\Arquivos de programas\AVAST Software\Avast\avastUI.exe

C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe

C:\Arquivos de programas\Keyboard Driver\KMConfig.exe

C:\Arquivos de programas\Yuna Software\Messenger Plus!\PlusService.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Firebird\Firebird_2_1\bin\fbserver.exe

C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Arquivos de programas\cacaoweb\cacaoweb.exe

C:\Arquivos de programas\Keyboard Driver\KMProcess.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\system32\cmd.exe

C:\WINDOWS\system32\ntvdm.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\Mozilla Firefox\plugin-container.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Arquivos de programas\Windows Live\Contacts\wlcomm.exe

C:\Documents and Settings\Administrador\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.oquefazernainternet.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.oquefazernainternet.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.oquefazernainternet.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.oquefazernainternet.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.oquefazernainternet.com/q/%s

O1 - Hosts: 69.162.112.196 wwwstatic.megavideo.com

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Arquivos de programas\Windows Live\Messenger\wlchtc.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Arquivos de programas\AVAST Software\Avast\aswWebRepIE.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll

O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - (no file)

O2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\Arquivos de programas\GbPlugin\gbiehcef.dll (file missing)

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Arquivos de programas\AVAST Software\Avast\aswWebRepIE.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Arquivos de programas\LogMeIn\x86\LogMeInSystray.exe"

O4 - HKLM\..\Run: [WinVNC] "C:\Arquivos de programas\UltraVNC\WinVNC.exe" -servicehelper

O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Arquivos de programas\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

O4 - HKLM\..\Run: [KMCONFIG] C:\Arquivos de programas\Keyboard Driver\StartAutorun.exe KMConfig.exe

O4 - HKLM\..\Run: [avast] "C:\Arquivos de programas\AVAST Software\Avast\avastUI.exe" /nogui

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [PlusService] C:\Arquivos de programas\Yuna Software\Messenger Plus!\PlusService.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] "C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [cacaoweb] "C:\Arquivos de programas\cacaoweb\cacaoweb.exe" -noplayer

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Google Sidewiki... - res://C:\Arquivos de programas\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Add to VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\ARQUIV~1\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL

O9 - Extra 'Tools' menuitem: Add to &VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\ARQUIV~1\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab

O16 - DPF: {7E866715-C9B6-4C64-AAB8-342E0D137213} (DVR4204 Client Control) - http://10.1.1.50:8000/EDVR.CAB

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O16 - DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} (GbpDistObj Class) - https://imagem.caixa.gov.br/cab/gbpdist.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{07C6FAA2-ACB6-451B-A842-7D395B23A074}: NameServer = 201.10.1.2,201.10.128.2

O17 - HKLM\System\CS1\Services\Tcpip\..\{07C6FAA2-ACB6-451B-A842-7D395B23A074}: NameServer = 201.10.1.2,201.10.128.2

O17 - HKLM\System\CS2\Services\Tcpip\..\{07C6FAA2-ACB6-451B-A842-7D395B23A074}: NameServer = 201.10.1.2,201.10.128.2

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveSystemServices.dll

O20 - Winlogon Notify: GbPluginCef - C:\Arquivos de programas\GbPlugin\gbiehCef.dll (file missing)

O23 - Service: avast! Antivirus - AVAST Software - C:\Arquivos de programas\AVAST Software\Avast\AvastSvc.exe

O23 - Service: avast! Firewall - AVAST Software - C:\Arquivos de programas\AVAST Software\Avast\afwServ.exe

O23 - Service: Servidor CIC (CICSERVER) - Unknown owner - C:\IntraChat\CICServer.exe

O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - Firebird Project - C:\Arquivos de programas\Firebird\Firebird_2_1\bin\fbguard.exe

O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - Firebird Project - C:\Arquivos de programas\Firebird\Firebird_2_1\bin\fbserver.exe

O23 - Service: Gbp Service (GbpSv) - Unknown owner - C:\ARQUIV~1\GbPlugin\GbpSv.exe (file missing)

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Arquivos de programas\Google\Update\GoogleUpdate.exe

O23 - Service: Serviço do Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Arquivos de programas\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe

O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Arquivos de programas\Keyboard Driver\KMWDSrv.exe

O23 - Service: LMIGuardianSvc - LogMeIn, Inc. - C:\Arquivos de programas\LogMeIn\x86\LMIGuardianSvc.exe

O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Arquivos de programas\LogMeIn\x86\RaMaint.exe

O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe

O23 - Service: MBAMService - Malwarebytes Corporation - C:\Arquivos de programas\Malwarebytes' Anti-Malware\mbamservice.exe

O23 - Service: MySql - Unknown owner - C:\MySQL\bin\mysqld-max.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: VNC Server (winvnc) - UltraVNC - C:\Arquivos de programas\UltraVNC\WinVNC.exe

--

End of file - 10981 bytes

wings · Agosto 10, 2011

Olá GildazioJr

1.

*Baixe o DDS e salve-o no desktop

*Execute-o e salve os relatórios (DDS.txt e Attach.txt) no desktop

*Cole o relatório DDS.txt

GildazioJr · Agosto 10, 2011

Olá Wings, muito obrigado pela ajuda, ai vai o log do DDS.

.

DDS (Ver_2011-06-23.01) - NTFSx86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20

Run by GildazioJr at 10:06:41 on 2011-08-10

Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.1015.56 [GMT -5:00]

.

AV: avast! Internet Security *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

FW: avast! Internet Security *Enabled*

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\Arquivos de programas\AVAST Software\Avast\afwServ.exe

C:\Arquivos de programas\AVAST Software\Avast\AvastSvc.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\IntraChat\CICServer.exe

C:\Arquivos de programas\Firebird\Firebird_2_1\bin\fbguard.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\Arquivos de programas\Keyboard Driver\KMWDSrv.exe

C:\Arquivos de programas\LogMeIn\x86\LMIGuardianSvc.exe

C:\Arquivos de programas\LogMeIn\x86\RaMaint.exe

C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe

C:\Arquivos de programas\Malwarebytes' Anti-Malware\mbamservice.exe

C:\MySQL\bin\mysqld-max.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Arquivos de programas\UltraVNC\WinVNC.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Firebird\Firebird_2_1\bin\fbserver.exe

C:\Arquivos de programas\LogMeIn\x86\LogMeInSystray.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\Arquivos de programas\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Arquivos de programas\Keyboard Driver\StartAutorun.exe

C:\Arquivos de programas\AVAST Software\Avast\avastUI.exe

C:\Arquivos de programas\Keyboard Driver\KMConfig.exe

C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe

C:\Arquivos de programas\Yuna Software\Messenger Plus!\PlusService.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Arquivos de programas\cacaoweb\cacaoweb.exe

C:\Arquivos de programas\Keyboard Driver\KMProcess.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Arquivos de programas\Mozilla Firefox\plugin-container.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Arquivos de programas\Windows Live\Contacts\wlcomm.exe

.

============== Pseudo HJT Report ===============

.

uSearch Page = hxxp://www.oquefazernainternet.com/

uSearchURL,(Default) = hxxp://www.oquefazernainternet.com/q/%s

mCustomizeSearch = hxxp://www.oquefazernainternet.com/

mSearchAssistant = hxxp://www.oquefazernainternet.com/

BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\arquivos de programas\adobe\acrobat 7.0\activex\AcroIEHelper.dll

BHO: Click-to-Call BHO: {5c255c8a-e604-49b4-9d64-90988571cecb} - c:\arquivos de programas\windows live\messenger\wlchtc.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\arquivos de programas\microsoft office\office12\GrooveShellExtensions.dll

BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\arquivos de programas\avast software\avast\aswWebRepIE.dll

BHO: Auxiliar de Conexão do Windows Live: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\arquivos de programas\arquivos comuns\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\arquivos de programas\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\arquivos de programas\google\googletoolbarnotifier\5.7.6406.1642\swg.dll

BHO: {C41A1C0E-EA6C-11D4-B1B8-444553540000} - No File

BHO: GbIehObj Class: {c41a1c0e-ea6c-11d4-b1b8-444553540003} - c:\arquivos de programas\gbplugin\gbiehcef.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\arquivos de programas\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\arquivos de programas\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\arquivos de programas\avast software\avast\aswWebRepIE.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\arquivos de programas\google\google toolbar\GoogleToolbar_32.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [swg] "c:\arquivos de programas\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [cacaoweb] "c:\arquivos de programas\cacaoweb\cacaoweb.exe" -noplayer

mRun: [LogMeIn GUI] "c:\arquivos de programas\logmein\x86\LogMeInSystray.exe"

mRun: [WinVNC] "c:\arquivos de programas\ultravnc\WinVNC.exe" -servicehelper

mRun: [Malwarebytes' Anti-Malware] "c:\arquivos de programas\malwarebytes' anti-malware\mbamgui.exe" /starttray

mRun: [KMCONFIG] c:\arquivos de programas\keyboard driver\StartAutorun.exe KMConfig.exe

mRun: [avast] "c:\arquivos de programas\avast software\avast\avastUI.exe" /nogui

mRun: [GrooveMonitor] "c:\arquivos de programas\microsoft office\office12\GrooveMonitor.exe"

mRun: [PlusService] c:\arquivos de programas\yuna software\messenger plus!\PlusService.exe

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\micros~2\office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\arquivos de programas\google\google toolbar\component\GoogleToolbarDynamic_mui_en_70C5B381380DB17F.dll/cmsidewiki.html

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\arquivos de programas\messenger\msmsgs.exe

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\arquiv~1\micros~2\office12\ONBttnIE.dll

IE: {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - {17A84966-F1E9-4645-AA9E-5E771EE1C859} - c:\arquiv~1\nuclea~1\videoget\plugins\VIDEOG~1.DLL

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\arquiv~1\micros~2\office12\REFIEBAR.DLL

DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab

DPF: {7E866715-C9B6-4C64-AAB8-342E0D137213} - hxxp://10.1.1.50:8000/EDVR.CAB

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} - hxxps://imagem.caixa.gov.br/cab/gbpdist.cab

TCP: Interfaces\{07C6FAA2-ACB6-451B-A842-7D395B23A074} : NameServer = 201.10.1.2,201.10.128.2

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\arquivos de programas\microsoft office\office12\GrooveSystemServices.dll

Notify: GbPluginCef - c:\arquivos de programas\gbplugin\gbiehCef.dll

Notify: igfxcui - igfxdev.dll

Notify: LMIinit - LMIinit.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\arquivos de programas\microsoft office\office12\GrooveShellExtensions.dll

SEH: {E37CB5F0-51F5-4395-A808-5FA49E399F83} - No File

SEH: GbPluginObj Class: {e37cb5f0-51f5-4395-a808-5fa49e399003} - c:\arquivos de programas\gbplugin\gbiehcef.dll

Hosts: 69.162.112.196 wwwstatic.megavideo.com

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\administrador\dados de aplicativos\mozilla\firefox\profiles\on8u2f4k.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.localstrike.com.ar/?q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.br

FF - prefs.js: keyword.URL - hxxp://search.localstrike.com.ar/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=

FF - component: c:\documents and settings\administrador\dados de aplicativos\mozilla\firefox\profiles\on8u2f4k.default\extensions\{87f8774f-b485-47e2-a755-a40a8a5e886c}\components\GbMzhBb.dll

FF - component: c:\documents and settings\administrador\dados de aplicativos\mozilla\firefox\profiles\on8u2f4k.default\extensions\{87f8774f-b485-47e2-a755-a40a8a5e886d}\components\GbMzhCef.dll

FF - component: c:\documents and settings\administrador\dados de aplicativos\mozilla\firefox\profiles\on8u2f4k.default\extensions\{87f8774f-b485-47e2-a755-a40a8a5e8874}\components\GbMzhAbn.dll

FF - plugin: c:\arquivos de programas\google\google earth\plugin\npgeplugin.dll

FF - plugin: c:\arquivos de programas\google\update\1.3.21.65\npGoogleUpdate3.dll

FF - plugin: c:\arquivos de programas\microsoft silverlight\4.0.60531.0\npctrlui.dll

FF - plugin: c:\arquivos de programas\microsoft\office live\npOLW.dll

FF - plugin: c:\arquivos de programas\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\documents and settings\administrador\dados de aplicativos\mozilla\firefox\profiles\on8u2f4k.default\extensions\{87f8774f-b485-47e2-a755-a40a8a5e886c}\plugins\npgbfnc_bb.dll

FF - plugin: c:\documents and settings\administrador\dados de aplicativos\mozilla\firefox\profiles\on8u2f4k.default\extensions\{87f8774f-b485-47e2-a755-a40a8a5e886d}\plugins\npgbfnc_cef.dll

.

============= SERVICES / DRIVERS ===============

.

R0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\drivers\aswNdis.sys [2011-2-26 12112]

R0 aswNdis2;avast! Firewall Core Firewall Service;c:\windows\system32\drivers\aswNdis2.sys [2011-2-26 194264]

R0 SEG02;SEG02;c:\windows\system32\drivers\SEG02.sys [2010-6-5 10368]

R1 aswFW;avast! TDI Firewall driver;c:\windows\system32\drivers\aswFW.sys [2011-2-26 103384]

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-2-26 441176]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-2-26 309848]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-2-26 19544]

R2 avast! Antivirus;avast! Antivirus;c:\arquivos de programas\avast software\avast\AvastSvc.exe [2011-2-26 42184]

R2 avast! Firewall;avast! Firewall;c:\arquivos de programas\avast software\avast\afwServ.exe [2011-2-26 121000]

R2 CICSERVER;Servidor CIC;c:\intrachat\CICServer.exe [2011-7-27 961536]

R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\arquivos de programas\firebird\firebird_2_1\bin\fbguard.exe [2010-11-17 81920]

R2 KMWDSERVICE;Keyboard And Mouse Communication Service;c:\arquivos de programas\keyboard driver\KMWDSrv.exe [2008-6-23 208896]

R2 LMIGuardianSvc;LMIGuardianSvc;c:\arquivos de programas\logmein\x86\LMIGuardianSvc.exe [2010-9-30 374152]

R2 LMIInfo;LogMeIn Kernel Information Provider;c:\arquivos de programas\logmein\x86\rainfo.sys [2007-8-3 12856]

R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2008-3-9 47640]

R2 MBAMService;MBAMService;c:\arquivos de programas\malwarebytes' anti-malware\mbamservice.exe [2010-3-3 236368]

R3 dfmirage;dfmirage;c:\windows\system32\drivers\dfmirage.sys [2005-11-25 31896]

R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\arquivos de programas\firebird\firebird_2_1\bin\fbserver.exe [2010-11-17 2736128]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-3-3 19160]

S0 ActBoot;ActBoot;c:\windows\system32\drivers\actboot.sys --> c:\windows\system32\drivers\ActBoot.sys [?]

S0 GbpKm;Gbp KernelMode;c:\windows\system32\drivers\gbpkm.sys --> c:\windows\system32\drivers\gbpkm.sys [?]

S0 pweien;pweien; [x]

S2 GbpSv;Gbp Service;c:\arquiv~1\gbplugin\gbpsv.exe --> c:\arquiv~1\gbplugin\GbpSv.exe [?]

S2 gupdate;Google Update Service (gupdate);c:\arquivos de programas\google\update\GoogleUpdate.exe [2010-2-23 135664]

S2 vnccom;vnccom;c:\windows\system32\drivers\vnccom.SYS [2008-3-9 6016]

S3 gupdatem;Serviço do Google Update (gupdatem);c:\arquivos de programas\google\update\GoogleUpdate.exe [2010-2-23 135664]

S3 PciCon;PciCon;\??\d:\pcicon.sys --> d:\PciCon.sys [?]

S3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [2010-9-2 16472]

S3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [2010-9-2 11104]

S4 LMIRfsClientNP;LMIRfsClientNP; [x]

.

=============== Created Last 30 ================

.

2011-07-28 20:22:57 -------- d-----w- c:\arquivos de programas\powersystem

2011-07-28 17:06:30 -------- d-----w- c:\arquivos de programas\gpmiv11_br

2011-07-28 17:06:30 -------- d-----w- c:\arquivos de programas\arquivos comuns\Crystal Decisions

2011-07-28 16:56:22 159742 ----a-w- c:\windows\Controle de Cheques GOLD Uninstaller.exe

2011-07-28 16:56:22 -------- d-----w- C:\ChequeGOLD

2011-07-28 14:37:07 -------- d-----w- C:\IndustriasManager

2011-07-28 14:33:22 -------- d-----w- c:\documents and settings\administrador\dados de aplicativos\EngeComp

2011-07-28 14:32:57 -------- d-----w- C:\EngeComp

2011-07-28 14:32:57 -------- d-----w- c:\documents and settings\all users\dados de aplicativos\EngeComp

2011-07-27 22:41:54 -------- d-----w- c:\arquivos de programas\DemoForge

2011-07-27 22:41:44 -------- d-----w- c:\arquivos de programas\SpeexW

2011-07-27 22:41:34 -------- d-----w- C:\IntraChat

.

==================== Find3M ====================

.

2011-07-28 14:37:46 49152 ----a-w- c:\windows\system32\u2fodbc.dll

2011-07-28 14:37:20 286720 ------w- c:\windows\Setup1.exe

2011-07-28 14:37:17 73216 ----a-w- c:\windows\ST6UNST.EXE

2011-07-06 21:32:48 83360 ----a-w- c:\windows\system32\LMIRfsClientNP.dll

2011-07-06 21:32:36 53632 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\LMIproc.dll

2011-07-06 21:32:28 87424 ----a-w- c:\windows\system32\LMIinit.dll

2011-07-06 21:32:28 29568 ----a-w- c:\windows\system32\LMIport.dll

2011-07-04 11:43:53 40112 ----a-w- c:\windows\avastSS.scr

2011-07-04 11:37:33 103384 ----a-w- c:\windows\system32\drivers\aswFW.sys

2011-07-04 11:36:43 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2011-07-04 11:36:18 194264 ----a-w- c:\windows\system32\drivers\aswNdis2.sys

2011-06-16 20:14:27 83360 ----a-w- c:\windows\system32\LMIRfsClientNP.dll.000.bak

2011-06-16 20:14:23 87424 ----a-w- c:\windows\system32\LMIinit.dll.000.bak

2011-06-06 11:35:23 1859072 ----a-w- c:\windows\system32\win32k.sys

.

============= FINISH: 10:09:47,62 ===============

Olá GildazioJr

1.

*Baixe o DDS e salve-o no desktop

*Execute-o e salve os relatórios (DDS.txt e Attach.txt) no desktop

*Cole o relatório DDS.txt

wings · Agosto 10, 2011

1.

*Baixe o Cacaokiller e salve-o no desktop

*Execute-o e tecle 2 > [ENTER]

*Cole o relatório apresentado

2.

*Abra o Malwarebytes, clique [Atualização] > [baixar Atualizações]

*Na aba [Verificação], selecione [x] Verificação completa

*Clique [Verificar] e selecione a partição onde o Windows está instalado

*Ao finalizar o scan, clique [sIM] > [OK] > [Ver Resultados] > [Remover Selecionados]

*Cole o relatório apresentado

GildazioJr · Agosto 10, 2011

Certo ai vao os logs respectivamente.

============================================================

########### Cacaokiller By Juju666 ###########

============================================================

Version 1.1.0.0

bits

Exécuté par GildazioJr le 10/08/2011 à 10:31:41

##################### Suppression:

### Fichiers et dossiers supprimés:

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03

Killing PID 892 'cacaoweb.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03

Error, Cannot find a process with an image name of opera.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03

Killing PID 3344 'msnmsgr.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03

Error, Cannot find a process with an image name of iexplore.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03

Killing PID 816 'firefox.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03

Error, Cannot find a process with an image name of safari.exe

Mis en quarantaine & Supprimé !! : "C:\Arquivos de programas\cacaoweb"

Mis en quarantaine & Supprimé !! : "C:\Arquivos de programas\cacaoweb\cacaoweb.exe"

Mis en quarantaine & Supprimé !! : "C:\Arquivos de programas\Megacubo\components\bin\cacaoweb.exe"

Mis en quarantaine & Supprimé !! : "C:\Documents and Settings\Administrador\Dados de aplicativos\cacaoweb"