Ir ao conteúdo
  • Comunicados

    • diego_moicano

      Gostaria de se tornar um analista em Remoção de Malware?   07-12-2015

      Gostaria de se tornar um analista em Remoção de Malware? O Fórum Clube do Hardware deu início a um programa de treinamento em análises de log. Os interessados deverão enviar um email para aprendizes (arroba) clubedohardware (ponto) com (ponto) br respondendo as seguintes perguntas: Por que você gostaria de aprender a analisar logs? Possui tempo hábil para o treinamento? Tem conhecimentos em informática? Se sim descreva-os. Possui inglês para leitura? Qual seu objetivo após completar o treinamento?   Não se esqueça de incluir no e-mail o seu nome de usuário (fornecer o link também), idade e cidade onde vive. Adicione também qualquer experiência e/ou razão sobre o porquê você seria um bom Analista. É digno de nota que apenas os que forem selecionados receberão resposta por MP (Mensagem Pessoal), não existe um padrão na escolha dos futuros aprendizes, todos os e-mails serão lidos e serão analisados de forma imparcial, portanto não será permitido reclamações neste aspecto. O treinamento é dado no próprio fórum. Quando um aprendiz é selecionado ele é movido para um novo grupo, onde terá acesso a fóruns fechados para os demais usuários onde poderá dar inicio ao seu treinamento. Importante: A cada 30 dias os e-mails não selecionados serão apagados, portanto você pode enviar um novo e-mail após 1 mês, e-mails enviados antes serão desconsiderados.  
    • Gabriel Torres

      Seja um moderador do Clube do Hardware!   12-02-2016

      Prezados membros do Clube do Hardware, Está aberto o processo de seleção de novos moderadores para diversos setores ou áreas do Clube do Hardware. Os requisitos são:   Pelo menos 500 posts e um ano de cadastro; Boa frequência de participação; Ser respeitoso, cordial e educado com os demais membros; Ter bom nível de português; Ter razoável conhecimento da área em que pretende atuar; Saber trabalhar em equipe (com os moderadores, coordenadores e administradores).   Os interessados deverão enviar uma mensagem privada para o usuário @Equipe Clube do Hardware com o título "Candidato a moderador". A mensagem deverá conter respostas às perguntas abaixo:   Qual o seu nome completo? Qual sua data de nascimento? Qual sua formação/profissão? Já atuou como moderador em algo outro fórum, se sim, qual? De forma sucinta, explique o porquê de querer ser moderador do fórum e conte-nos um pouco sobre você.   OBS: Não se trata de função remunerada. Todos que fazem parte do staff são voluntários.
Entre para seguir isso  
M7L

Problema ao iniciar o Windows, erro em gbiehbsb.dll, falta a entrada FocarNotify

Recommended Posts

É isso, toda a vez que inicio o Windows aparece uma mensagem com o título RunDll que diz:Erro em gbiehbsb.dll, está faltando a entrada Focar Notify

Alguém pode me ajudar?

plz

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:15:02, on 24/3/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE

C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

C:\Arquivos de programas\Ares Ultra\Ares Ultra.exe

C:\Arquivos de programas\Ares Galaxy Turbo Accelerator\Ares Galaxy Turbo Accelerator.exe

C:\Arquivos de programas\MSN Messenger\usnsvc.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\Ares Galaxy FasterDownload\Ares Galaxy FasterDownload.exe

C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\system32\wscntfy.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar1.dll (file missing)

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll

O2 - BHO: Banco do Brasil S.A. - {FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB} - C:\WINDOWS\gbiehbsb.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar1.dll (file missing)

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [file wave user bat] C:\Documents and Settings\All Users\Dados de aplicativos\Mail For File Wave\open mix.exe

O4 - HKLM\..\Run: [AXIS TONS THE MP3] C:\Documents and Settings\All Users\Dados de aplicativos\Readme Live Axis Tons\Bias Media.exe

O4 - HKLM\..\Run: [egui] "C:\Arquivos de programas\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [ares ultra] "C:\Arquivos de programas\Ares Ultra\Ares Ultra.exe" -h

O4 - HKLM\..\Policies\Explorer\Run: [gbieh.1] rundll32 C:\WINDOWS\gbiehbsb.dll ForcarNotify

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Ares Galaxy Turbo Accelerator.lnk = C:\Arquivos de programas\Ares Galaxy Turbo Accelerator\Ares Galaxy Turbo Accelerator.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab

O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{AD471B17-AAC7-4E49-B260-6B5E32C0B005}: NameServer = 200.143.64.10,201.35.68.130

O17 - HKLM\System\CCS\Services\Tcpip\..\{B43880F5-6284-43D1-ADE3-10FAEF3AFCA6}: NameServer = 200.143.64.10,201.35.68.130

O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Arquivos de programas\Ares Ultra\chatServer.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)

O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

--

End of file - 8350 bytes

Compartilhar este post


Link para o post
Compartilhar em outros sites

- Faça o download do ComboFix

  • Desative, temporariamente, o antivírus;
  • Feche todas as janelas abertas;
  • Dê um duplo-clique no ComboFix.exe, clique em "Executar" e digite "1" + Enter para prosseguir o Fix. Pode demorar algum tempo.
  • O ComboFix poderá reiniciar o PC automaticamente para completar o processo de remoção.
  • Quando terminar, será gerado um log, que estará em C:\ComboFix.txt.
  • Não clique na Janela do ComboFix, nem o feche clicando no X, enquanto estiver rodando, não mova o mouse e não use o teclado, pois senão irá parar e seu desktop ficará em branco.
  • Para parar ou sair do ComboFix, tecle "N".
  • Cole o ComboFix.txt na sua resposta.

Compartilhar este post


Link para o post
Compartilhar em outros sites
  • Autor do tópico
  • ComboFix 08-03-24.2 - Italo 2008-03-25 9:28:34.1 - NTFSx86

    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.193 [GMT -3:00]

    Executando de: C:\Documents and Settings\Italo\Desktop\ComboFix.exe

    * Criado um novo ponto de restauro

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    .

    ((((((((((((((((((((((((((((((((((((( Outras Exclusäes )))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    C:\WINDOWS\mssnmsgr.dll

    C:\WINDOWS\winhlp.dll

    .

    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    -------\Legacy_NWSAPAGENT

    -------\Service_NwSapAgent

    ((((((((((((((((((((((( Ficheiros criados de 2008-02-25 to 2008-03-25 ))))))))))))))))))))))))))))))))

    .

    2008-03-24 23:09 . 2008-03-24 23:11 <DIR> d-------- C:\Documents and Settings\Italo\Dados de aplicativos\BSplayer PRO

    2008-03-24 23:09 . 2008-03-24 23:09 <DIR> d-------- C:\Arquivos de programas\Webteh

    2008-03-24 12:07 . 2008-03-24 12:07 <DIR> d-------- C:\Arquivos de programas\Ares

    2008-03-24 10:22 . 2008-03-24 10:22 <DIR> d-------- C:\Arquivos de programas\Trend Micro

    2008-03-22 17:24 . 2008-03-22 17:24 <DIR> d-------- C:\Arquivos de programas\OneStepSearch

    2008-03-22 17:24 . 2008-03-23 02:05 <DIR> d-------- C:\Arquivos de programas\Ares Galaxy FasterDownload

    2008-03-22 17:24 . 2001-09-06 10:00 1,700,352 --a------ C:\WINDOWS\system32\gdiplus.dll

    2008-03-22 17:24 . 2007-06-25 14:02 475,136 --a------ C:\WINDOWS\system32\SkinCrafter2.dll

    2008-03-22 17:07 . 2008-03-23 02:05 <DIR> d-------- C:\Arquivos de programas\Ares Galaxy Turbo Accelerator

    2008-03-20 14:07 . 2008-03-20 14:07 <DIR> d-------- C:\Arquivos de programas\Ares Ultra

    2008-03-19 20:21 . 2008-03-19 20:21 1,190 --a------ C:\WINDOWS\mozver.dat

    2008-03-19 20:08 . 2008-03-19 20:08 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy

    2008-03-18 23:32 . 2008-03-18 23:32 0 --a------ C:\WINDOWS\nsreg.dat

    2008-03-18 12:00 . 2008-03-18 12:00 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\ESET

    2008-03-14 18:49 . 2008-03-20 00:25 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Symantec Shared

    2008-03-14 16:43 . 2008-03-24 21:22 <DIR> d-------- C:\Arquivos de programas\Web Photo Album

    2008-03-14 16:43 . 2008-03-14 16:43 <DIR> d-------- C:\Arquivos de programas\Cartoonist

    2008-03-14 15:16 . 2008-03-14 16:00 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy

    2008-03-14 15:16 . 2008-03-14 15:17 <DIR> d-------- C:\Arquivos de programas\Spybot - Search & Destroy

    2008-03-13 16:01 . 2008-03-13 16:01 1,599 --a------ C:\WINDOWS\system32\MRT.INI

    2008-03-05 19:03 . 2008-03-19 18:00 <DIR> d-------- C:\Arquivos de programas\Norton Security Scan

    2008-02-26 15:32 . 2008-02-26 15:32 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Readme Live Axis Tons

    2008-02-26 15:28 . 2008-02-26 15:28 <DIR> d-------- C:\Arquivos de programas\AtomOwnsFord

    2008-02-25 08:29 . 2008-02-25 08:29 268 --ah----- C:\sqmdata14.sqm

    2008-02-25 08:29 . 2008-02-25 08:29 244 --ah----- C:\sqmnoopt15.sqm

    2008-02-25 08:29 . 2008-02-25 08:29 244 --ah----- C:\sqmnoopt14.sqm

    2008-02-25 08:29 . 2008-02-25 08:29 136 --ah----- C:\sqmdata16.sqm

    2008-02-25 08:29 . 2008-02-25 08:29 136 --ah----- C:\sqmdata15.sqm

    .

    ((((((((((((((((((((((((((((((((((((( Relat¢rio Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2008-03-22 22:29 --------- d-----w C:\Documents and Settings\Italo\Dados de aplicativos\LimeWire

    2008-03-20 15:11 --------- d-----w C:\Arquivos de programas\Google

    2008-03-14 02:27 --------- d-----w C:\Arquivos de programas\Circle Developement

    2008-02-26 18:28 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Mail For File Wave

    2008-02-23 17:58 --------- d-----w C:\Arquivos de programas\DAP

    2008-02-23 17:56 86,788 ----a-w C:\WINDOWS\svcpool.dll

    2008-02-23 17:55 --------- d---a-w C:\Documents and Settings\All Users\Dados de aplicativos\TEMP

    2008-02-23 17:53 757,248 ----a-w C:\WINDOWS\gbiehbsb.dll

    2008-02-21 00:08 --------- d-----w C:\Arquivos de programas\LimeWire

    2008-02-06 21:33 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Messenger Plus!

    2008-02-01 13:38 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\CyberLink

    2008-01-28 19:17 --------- d-----w C:\Documents and Settings\Italo\Dados de aplicativos\HP

    2007-12-31 11:14 3,381,280 ----a-w C:\Arquivos de programas\LimeWireWin.exe

    2007-12-31 11:04 382,352 ----a-w C:\Arquivos de programas\jre-6u2-windows-i586-p-iftw.exe

    2007-12-29 12:28 477,658 ----a-w C:\Arquivos de programas\ENL832-TX-ICNT_Drivers.zip

    .

    (((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

    .

    .

    REGEDIT4

    *Nota* entradas vazias & leg¡timas por defeito nÆo sÆo mostradas.

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB}]

    2008-02-23 14:53 757248 --a------ C:\WINDOWS\gbiehbsb.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:45 15360]

    "swg"="C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-02-02 11:59 68856]

    "MSMSGS"="C:\Arquivos de programas\Messenger\msmsgs.exe" [2004-10-13 13:24 1694208]

    "SpybotSD TeaTimer"="C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46 1460560]

    "ares ultra"="C:\Arquivos de programas\Ares Ultra\Ares Ultra.exe" [2007-05-23 10:31 2831360]

    "ares"="C:\Arquivos de programas\Ares\Ares.exe" [2008-02-20 11:33 963072]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "avast!"="C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 10:00 79224]

    "file wave user bat"="C:\Documents and Settings\All Users\Dados de aplicativos\Mail For File Wave\open mix.exe" [ ]

    "AXIS TONS THE MP3"="C:\Documents and Settings\All Users\Dados de aplicativos\Readme Live Axis Tons\Bias Media.exe" [2008-03-25 09:32 1296896]

    "egui"="C:\Arquivos de programas\ESET\ESET NOD32 Antivirus\egui.exe" [ ]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:45 15360]

    "Picasa Media Detector"="C:\Arquivos de programas\Picasa2\PicasaMediaDetector.exe" [2007-10-23 18:18 443968]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

    "gbieh.1"= rundll32 C:\WINDOWS\gbiehbsb.dll ForcarNotify

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

    Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^HP Digital Imaging Monitor.lnk]

    path=C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\HP Digital Imaging Monitor.lnk

    backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

    --a------ 2007-05-11 02:06 40048 C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]

    C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]

    --a------ 2004-08-04 00:45 15360 C:\WINDOWS\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]

    -ra------ 2004-10-07 21:27 126976 C:\WINDOWS\system32\hkcmd.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

    --a------ 2005-05-11 22:12 49152 C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]

    -ra------ 2004-10-07 21:31 155648 C:\WINDOWS\system32\igfxtray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]

    --a------ 2007-05-15 14:55 1057328 C:\Arquivos de programas\Nero\Nero 7\InCD\InCD.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]

    --a------ 2006-12-05 21:55 54832 C:\Arquivos de programas\CyberLink\PowerDVD\Language\Language.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]

    --a------ 2007-01-19 11:54 5674352 C:\Arquivos de programas\MSN Messenger\MsnMsgr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

    --a------ 2007-03-01 14:57 153136 C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]

    --a------ 2007-10-23 18:18 443968 C:\Arquivos de programas\Picasa2\PicasaMediaDetector.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]

    --------- 2006-11-23 14:10 56928 C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc]

    --a------ 2007-05-15 14:55 1628208 C:\Arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]

    --a------ 2005-12-14 17:06 577536 C:\WINDOWS\soundman.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

    --a------ 2007-07-12 03:00 132496 C:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

    "%windir%\\system32\\sessmgr.exe"=

    "C:\\Arquivos de programas\\MSN Messenger\\msnmsgr.exe"=

    "C:\\Arquivos de programas\\MSN Messenger\\livecall.exe"=

    "C:\\Arquivos de programas\\LimeWire\\LimeWire.exe"=

    "C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

    "C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

    "C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

    "C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

    "C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hposid01.exe"=

    "C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

    "C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

    "C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

    "C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

    "C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

    "C:\\Arquivos de programas\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

    "C:\\Arquivos de programas\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

    "C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

    "C:\\Arquivos de programas\\Ares\\Ares.exe"=

    "C:\\Arquivos de programas\\Ares Ultra\\Ares Ultra.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

    "5000:TCP"= 5000:TCP:AresChatServer

    S3 ip100xp;ENCORE 10/100Mbps Fast Ethernet PCI Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\ipfnd51.sys [2005-04-06 10:30]

    S3 Revolution1;Revolution1;C:\DOCUME~1\Italo\CONFIG~1\Temp\Rar$EX00.297\Revolution Engine 7.2\SHAK3.sys []

    S3 XDva031;XDva031;C:\WINDOWS\system32\XDva031.sys []

    S3 XDva068;XDva068;C:\WINDOWS\system32\XDva068.sys []

    S3 XDva081;XDva081;C:\WINDOWS\system32\XDva081.sys []

    .

    Conte£do da pasta 'Tarefas Agendadas'

    "2008-03-19 21:26:33 C:\WINDOWS\Tasks\Norton Security Scan.job"

    - C:\Arquivos de programas\Norton Security Scan\Nss.exe

    .

    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

    Rootkit scan 2008-03-25 09:32:34

    Windows 5.1.2600 Service Pack 2 NTFS

    Procurando processos ocultos ...

    Procurando entradas auto inicializ veis ocultas ...

    Procurando ficheiros ocultos ...

    Varredura completada com sucesso

    Ficheiros ocultos: 0

    **************************************************************************

    .

    ------------------------ Other Running Processes ------------------------

    .

    C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

    C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

    C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

    C:\WINDOWS\system32\HPZipm12.exe

    C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

    C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

    C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

    C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE

    C:\Arquivos de programas\Ares Galaxy Turbo Accelerator\Ares Galaxy Turbo Accelerator.exe

    .

    **************************************************************************

    .

    Tempo para conclusÆo: 2008-03-25 9:34:55 - machine was rebooted

    ComboFix-quarantined-files.txt 2008-03-25 12:34:45

    .

    2008-03-13 19:01:35 --- E O F ---

    E o novo log do Hijack This

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 09:37:40, on 25/3/2008

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v7.00 (7.00.6000.16608)

    Boot mode: Normal

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

    C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

    C:\WINDOWS\system32\HPZipm12.exe

    C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

    C:\WINDOWS\system32\svchost.exe

    C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

    C:\Arquivos de programas\Messenger\msmsgs.exe

    C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

    C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE

    C:\Arquivos de programas\Ares Ultra\Ares Ultra.exe

    C:\Arquivos de programas\Ares Galaxy Turbo Accelerator\Ares Galaxy Turbo Accelerator.exe

    C:\WINDOWS\system32\wuauclt.exe

    C:\WINDOWS\explorer.exe

    C:\Arquivos de programas\Mozilla Firefox\firefox.exe

    C:\WINDOWS\system32\wscntfy.exe

    C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

    O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll

    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar1.dll (file missing)

    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll

    O2 - BHO: Banco do Brasil S.A. - {FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB} - C:\WINDOWS\gbiehbsb.dll

    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar1.dll (file missing)

    O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

    O4 - HKLM\..\Run: [file wave user bat] C:\Documents and Settings\All Users\Dados de aplicativos\Mail For File Wave\open mix.exe

    O4 - HKLM\..\Run: [AXIS TONS THE MP3] C:\Documents and Settings\All Users\Dados de aplicativos\Readme Live Axis Tons\Bias Media.exe

    O4 - HKLM\..\Run: [egui] "C:\Arquivos de programas\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

    O4 - HKCU\..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

    O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background

    O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

    O4 - HKCU\..\Run: [ares ultra] "C:\Arquivos de programas\Ares Ultra\Ares Ultra.exe" -h

    O4 - HKCU\..\Run: [ares] "C:\Arquivos de programas\Ares\Ares.exe" -h

    O4 - HKLM\..\Policies\Explorer\Run: [gbieh.1] rundll32 C:\WINDOWS\gbiehbsb.dll ForcarNotify

    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

    O4 - Startup: Ares Galaxy Turbo Accelerator.lnk = C:\Arquivos de programas\Ares Galaxy Turbo Accelerator\Ares Galaxy Turbo Accelerator.exe

    O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll

    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll

    O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

    O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab

    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab

    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab

    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

    O17 - HKLM\System\CCS\Services\Tcpip\..\{AD471B17-AAC7-4E49-B260-6B5E32C0B005}: NameServer = 200.143.64.10,201.35.68.130

    O17 - HKLM\System\CCS\Services\Tcpip\..\{B43880F5-6284-43D1-ADE3-10FAEF3AFCA6}: NameServer = 200.143.64.10,201.35.68.130

    O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Arquivos de programas\Ares Ultra\chatServer.exe

    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

    O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

    O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)

    O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

    O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

    O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

    --

    End of file - 8244 bytes

    Compartilhar este post


    Link para o post
    Compartilhar em outros sites

    - Selecione o texto abaixo e copie para o bloco de notas. Salve-o como CFScript.txt;

    File::
    C:\WINDOWS\svcpool.dll
    C:\WINDOWS\gbiehbsb.dll
    Registry::
    [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
    "gbieh.1"=-

    - Arraste o CFScript.txt para o ComboFix conforme a imagem abaixo:

    CF_Script.gif

    O ComboFix irá rodar e reiniciará o PC automaticamente para completar o processo de remoção.

    Não use o mouse nem o teclado quando o ComboFix estiver rodando.

    Quando terminar, será gerado um log, que estará em C:\ComboFix.txt.

    Obs: Se o Combofix não reiniciar seu computador automaticamente, faça-o manualmente.

    Na sua próxima resposta, cole o ComboFix.txt e um novo log do HijackThis.

    Compartilhar este post


    Link para o post
    Compartilhar em outros sites
  • Autor do tópico
  • ComboFix 08-03-24.2 - Italo 2008-03-31 11:35:19.2 - NTFSx86

    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.190 [GMT -3:00]

    Executando de: C:\Documents and Settings\Italo\Desktop\ComboFix.exe

    Command switches used :: C:\Documents and Settings\Italo\Desktop\CFScript.txt

    * Criado um novo ponto de restauro

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::

    C:\WINDOWS\gbiehbsb.dll

    C:\WINDOWS\svcpool.dll

    .

    ((((((((((((((((((((((((((((((((((((( Outras Exclusäes )))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    C:\WINDOWS\gbiehbsb.dll

    C:\WINDOWS\svcpool.dll

    .

    ((((((((((((((((((((((( Ficheiros criados de 2008-02-28 to 2008-03-31 ))))))))))))))))))))))))))))))))

    .

    2008-03-31 11:37 . 2008-03-31 11:37 6,736 --a------ C:\WINDOWS\system32\drivers\PROCEXP90.SYS

    2008-03-28 00:45 . 2008-03-28 00:45 <DIR> d-------- C:\Documents and Settings\Italo\Dados de aplicativos\Comodo

    2008-03-28 00:45 . 2008-03-28 00:47 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\comodo

    2008-03-28 00:45 . 2008-03-28 00:45 <DIR> d-------- C:\Arquivos de programas\COMODO

    2008-03-28 00:45 . 2008-03-28 00:45 139,008 --a------ C:\WINDOWS\system32\guard32.dll

    2008-03-28 00:45 . 2008-03-28 00:45 81,272 --a------ C:\WINDOWS\system32\drivers\cmdGuard.sys

    2008-03-28 00:45 . 2008-03-28 00:45 23,672 --a------ C:\WINDOWS\system32\drivers\cmdhlp.sys

    2008-03-26 11:58 . 2008-03-26 11:58 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Lavasoft

    2008-03-26 11:58 . 2008-03-26 11:58 <DIR> d-------- C:\Arquivos de programas\Lavasoft

    2008-03-26 11:57 . 2008-03-26 11:57 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Wise Installation Wizard

    2008-03-25 11:38 . 2008-03-25 11:38 <DIR> d-------- C:\Documents and Settings\Italo\Dados de aplicativos\Image Zone Express

    2008-03-25 09:34 . 2008-03-25 09:34 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\Configurações locais

    2008-03-25 09:34 . 2008-03-25 09:34 <DIR> d-------- C:\Documents and Settings\NetworkService\Configurações locais

    2008-03-25 09:34 . 2008-03-25 09:34 <DIR> d-------- C:\Documents and Settings\LocalService\Configurações locais

    2008-03-25 09:34 . 2008-03-25 09:34 <DIR> d-------- C:\Documents and Settings\Italo\Configurações locais

    2008-03-24 23:09 . 2008-03-25 18:39 <DIR> d-------- C:\Documents and Settings\Italo\Dados de aplicativos\BSplayer PRO

    2008-03-24 23:09 . 2008-03-24 23:09 <DIR> d-------- C:\Arquivos de programas\Webteh

    2008-03-24 12:07 . 2008-03-24 12:07 <DIR> d-------- C:\Arquivos de programas\Ares

    2008-03-24 10:22 . 2008-03-24 10:22 <DIR> d-------- C:\Arquivos de programas\Trend Micro

    2008-03-22 17:24 . 2008-03-22 17:24 <DIR> d-------- C:\Arquivos de programas\OneStepSearch

    2008-03-22 17:24 . 2008-03-23 02:05 <DIR> d-------- C:\Arquivos de programas\Ares Galaxy FasterDownload

    2008-03-22 17:24 . 2001-09-06 10:00 1,700,352 --a------ C:\WINDOWS\system32\gdiplus.dll

    2008-03-22 17:24 . 2007-06-25 14:02 475,136 --a------ C:\WINDOWS\system32\SkinCrafter2.dll

    2008-03-22 17:07 . 2008-03-23 02:05 <DIR> d-------- C:\Arquivos de programas\Ares Galaxy Turbo Accelerator

    2008-03-20 14:07 . 2008-03-20 14:07 <DIR> d-------- C:\Arquivos de programas\Ares Ultra

    2008-03-19 20:21 . 2008-03-19 20:21 1,190 --a------ C:\WINDOWS\mozver.dat

    2008-03-19 20:08 . 2008-03-19 20:08 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy

    2008-03-18 23:32 . 2008-03-18 23:32 0 --a------ C:\WINDOWS\nsreg.dat

    2008-03-18 12:00 . 2008-03-18 12:00 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\ESET

    2008-03-14 18:49 . 2008-03-27 20:01 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Symantec Shared

    2008-03-14 16:43 . 2008-03-24 21:22 <DIR> d-------- C:\Arquivos de programas\Web Photo Album

    2008-03-14 16:43 . 2008-03-14 16:43 <DIR> d-------- C:\Arquivos de programas\Cartoonist

    2008-03-14 15:16 . 2008-03-14 16:00 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy

    2008-03-14 15:16 . 2008-03-14 15:17 <DIR> d-------- C:\Arquivos de programas\Spybot - Search & Destroy

    2008-03-13 16:01 . 2008-03-13 16:01 1,599 --a------ C:\WINDOWS\system32\MRT.INI

    2008-03-05 19:03 . 2008-03-26 18:00 <DIR> d-------- C:\Arquivos de programas\Norton Security Scan

    2008-02-26 15:32 . 2008-02-26 15:32 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Readme Live Axis Tons

    2008-02-25 08:29 . 2008-02-25 08:29 268 --ah----- C:\sqmdata14.sqm

    2008-02-25 08:29 . 2008-02-25 08:29 244 --ah----- C:\sqmnoopt15.sqm

    2008-02-25 08:29 . 2008-02-25 08:29 244 --ah----- C:\sqmnoopt14.sqm

    2008-02-25 08:29 . 2008-02-25 08:29 136 --ah----- C:\sqmdata16.sqm

    2008-02-25 08:29 . 2008-02-25 08:29 136 --ah----- C:\sqmdata15.sqm

    2008-02-23 15:18 . 2008-02-23 15:18 <DIR> d-------- C:\WINDOWS\_tmp

    2008-02-23 14:50 . 2008-03-12 15:25 3,408 --a------ C:\WINDOWS\svchost

    2008-02-01 21:03 . 2008-02-01 21:03 268 --ah----- C:\sqmdata12.sqm

    2008-02-01 21:03 . 2008-02-01 21:03 244 --ah----- C:\sqmnoopt12.sqm

    2008-02-01 19:37 . 2008-03-26 00:25 <DIR> d-------- C:\Documents and Settings\Italo\Dados de aplicativos\LimeWire

    2008-02-01 10:25 . 2008-02-01 10:25 268 --ah----- C:\sqmdata11.sqm

    2008-02-01 10:25 . 2008-02-01 10:25 244 --ah----- C:\sqmnoopt11.sqm

    .

    ((((((((((((((((((((((((((((((((((((( Relat¢rio Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2008-03-14 02:27 --------- d-----w C:\Arquivos de programas\Circle Developement

    2008-02-26 18:28 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Mail For File Wave

    2008-02-23 17:58 --------- d-----w C:\Arquivos de programas\DAP

    2008-02-23 17:55 --------- d---a-w C:\Documents and Settings\All Users\Dados de aplicativos\TEMP

    2008-02-21 00:08 --------- d-----w C:\Arquivos de programas\LimeWire

    2008-02-06 21:33 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Messenger Plus!

    2008-02-01 13:38 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\CyberLink

    2008-01-28 19:17 --------- d-----w C:\Documents and Settings\Italo\Dados de aplicativos\HP

    2007-12-31 11:14 3,381,280 ----a-w C:\Arquivos de programas\LimeWireWin.exe

    2007-12-31 11:04 382,352 ----a-w C:\Arquivos de programas\jre-6u2-windows-i586-p-iftw.exe

    2007-12-29 12:28 477,658 ----a-w C:\Arquivos de programas\ENL832-TX-ICNT_Drivers.zip

    .

    ((((((((((((((((((((((((((((( snapshot@2008-03-25_ 9.34.26.56 )))))))))))))))))))))))))))))))))))))))))

    .

    + 2008-03-26 14:58:29 1,038,336 ----a-r C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\Icon0E6AB9FC.exe

    + 2008-03-26 14:58:29 178,688 ----a-r C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\Icon0E6AB9FC1.exe

    + 2008-03-26 14:58:29 171,008 ----a-r C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\IconDED53B0B.exe

    + 2008-03-26 14:58:29 8,704 ----a-r C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\IconDED53B0B1.exe

    + 2007-07-11 16:37:26 6,272 ----a-w C:\WINDOWS\system32\drivers\AWRTPD.sys

    + 2007-08-07 15:58:08 8,320 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys

    + 2008-03-28 03:45:47 75,384 ----a-w C:\WINDOWS\system32\drivers\inspect.sys

    + 2007-08-07 15:56:58 9,344 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys

    + 2007-04-13 17:19:52 7,680 ----a-w C:\WINDOWS\system32\lsdelete.exe

    + 2008-03-31 14:38:32 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_4fc.dat

    .

    (((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

    .

    .

    REGEDIT4

    *Nota* entradas vazias & leg¡timas por defeito nÆo sÆo mostradas.

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB}]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:45 15360]

    "swg"="C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]

    "MSMSGS"="C:\Arquivos de programas\Messenger\msmsgs.exe" [2004-10-13 13:24 1694208]

    "SpybotSD TeaTimer"="C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46 1460560]

    "ares"="C:\Arquivos de programas\Ares\Ares.exe" [2008-02-20 11:33 963072]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "avast!"="C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 10:00 79224]

    "file wave user bat"="C:\Documents and Settings\All Users\Dados de aplicativos\Mail For File Wave\open mix.exe" [ ]

    "AXIS TONS THE MP3"="C:\Documents and Settings\All Users\Dados de aplicativos\Readme Live Axis Tons\Bias Media.exe" [2008-03-31 11:39 1305600]

    "COMODO Firewall Pro"="C:\Arquivos de programas\COMODO\Firewall\cfp.exe" [2008-03-28 00:45 1481472]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:45 15360]

    "Picasa Media Detector"="C:\Arquivos de programas\Picasa2\PicasaMediaDetector.exe" [ ]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

    "AppInit_DLLs"= C:\WINDOWS\system32\guard32.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

    Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^HP Digital Imaging Monitor.lnk]

    path=C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\HP Digital Imaging Monitor.lnk

    backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

    --a------ 2007-05-11 02:06 40048 C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]

    C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]

    --a------ 2004-08-04 00:45 15360 C:\WINDOWS\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]

    -ra------ 2004-10-07 21:27 126976 C:\WINDOWS\system32\hkcmd.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

    --a------ 2005-05-11 22:12 49152 C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]

    -ra------ 2004-10-07 21:31 155648 C:\WINDOWS\system32\igfxtray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]

    --a------ 2007-05-15 14:55 1057328 C:\Arquivos de programas\Nero\Nero 7\InCD\InCD.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]

    --a------ 2006-12-05 21:55 54832 C:\Arquivos de programas\CyberLink\PowerDVD\Language\Language.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]

    --a------ 2007-01-19 11:54 5674352 C:\Arquivos de programas\MSN Messenger\MsnMsgr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

    --a------ 2007-03-01 14:57 153136 C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]

    C:\Arquivos de programas\Picasa2\PicasaMediaDetector.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]

    --------- 2006-11-23 14:10 56928 C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc]

    --a------ 2007-05-15 14:55 1628208 C:\Arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]

    --a------ 2005-12-14 17:06 577536 C:\WINDOWS\soundman.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

    --a------ 2007-07-12 03:00 132496 C:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

    "%windir%\\system32\\sessmgr.exe"=

    "C:\\Arquivos de programas\\MSN Messenger\\msnmsgr.exe"=

    "C:\\Arquivos de programas\\MSN Messenger\\livecall.exe"=

    "C:\\Arquivos de programas\\LimeWire\\LimeWire.exe"=

    "C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

    "C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

    "C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

    "C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

    "C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hposid01.exe"=

    "C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

    "C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

    "C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

    "C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

    "C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

    "C:\\Arquivos de programas\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

    "C:\\Arquivos de programas\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

    "C:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

    "C:\\Arquivos de programas\\Ares\\Ares.exe"=

    "C:\\Arquivos de programas\\Ares Ultra\\Ares Ultra.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

    "5000:TCP"= 5000:TCP:AresChatServer

    R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-03-28 00:45]

    R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-03-28 00:45]

    S3 ip100xp;ENCORE 10/100Mbps Fast Ethernet PCI Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\ipfnd51.sys [2005-04-06 10:30]

    S3 Revolution1;Revolution1;C:\DOCUME~1\Italo\CONFIG~1\Temp\Rar$EX00.297\Revolution Engine 7.2\SHAK3.sys []

    S3 XDva031;XDva031;C:\WINDOWS\system32\XDva031.sys []

    S3 XDva068;XDva068;C:\WINDOWS\system32\XDva068.sys []

    S3 XDva081;XDva081;C:\WINDOWS\system32\XDva081.sys []

    .

    Conte£do da pasta 'Tarefas Agendadas'

    "2008-03-26 21:46:46 C:\WINDOWS\Tasks\Norton Security Scan.job"

    - C:\Arquivos de programas\Norton Security Scan\Nss.exe

    .

    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

    Rootkit scan 2008-03-31 11:39:40

    Windows 5.1.2600 Service Pack 2 NTFS

    Procurando processos ocultos ...

    Procurando entradas auto inicializ veis ocultas ...

    Procurando ficheiros ocultos ...

    Varredura completada com sucesso

    Ficheiros ocultos: 0

    **************************************************************************

    .

    ------------------------ Other Running Processes ------------------------

    .

    C:\Arquivos de programas\Lavasoft\Ad-Aware 2007\aawservice.exe

    C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

    C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

    C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

    C:\WINDOWS\system32\HPZipm12.exe

    C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

    C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

    C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

    C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE

    .

    **************************************************************************

    .

    Tempo para conclusÆo: 2008-03-31 11:42:16 - machine was rebooted

    ComboFix-quarantined-files.txt 2008-03-31 14:42:11

    ComboFix2.txt 2008-03-25 12:34:56

    .

    2008-03-13 19:01:35 --- E O F ---

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 11:44:26, on 31/3/2008

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v7.00 (7.00.6000.16608)

    Boot mode: Normal

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Arquivos de programas\Lavasoft\Ad-Aware 2007\aawservice.exe

    C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

    C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\Arquivos de programas\COMODO\Firewall\cmdagent.exe

    C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

    C:\WINDOWS\system32\HPZipm12.exe

    C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

    C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

    C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE

    C:\Arquivos de programas\Messenger\msmsgs.exe

    C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

    C:\Arquivos de programas\Ares\Ares.exe

    C:\WINDOWS\system32\wuauclt.exe

    C:\WINDOWS\explorer.exe

    C:\Arquivos de programas\Mozilla Firefox\firefox.exe

    C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

    C:\WINDOWS\system32\wscntfy.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

    O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll

    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar1.dll (file missing)

    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll (file missing)

    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar1.dll (file missing)

    O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

    O4 - HKLM\..\Run: [file wave user bat] C:\Documents and Settings\All Users\Dados de aplicativos\Mail For File Wave\open mix.exe

    O4 - HKLM\..\Run: [AXIS TONS THE MP3] C:\Documents and Settings\All Users\Dados de aplicativos\Readme Live Axis Tons\Bias Media.exe

    O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Arquivos de programas\COMODO\Firewall\cfp.exe" -s

    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

    O4 - HKCU\..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

    O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background

    O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

    O4 - HKCU\..\Run: [ares] "C:\Arquivos de programas\Ares\Ares.exe" -h

    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

    O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll

    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll

    O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

    O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab

    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab

    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab

    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

    O17 - HKLM\System\CCS\Services\Tcpip\..\{AD471B17-AAC7-4E49-B260-6B5E32C0B005}: NameServer = 200.143.64.10,201.35.68.130

    O17 - HKLM\System\CCS\Services\Tcpip\..\{B43880F5-6284-43D1-ADE3-10FAEF3AFCA6}: NameServer = 200.143.64.10,201.35.68.130

    O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll

    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Arquivos de programas\Lavasoft\Ad-Aware 2007\aawservice.exe

    O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Arquivos de programas\Ares Ultra\chatServer.exe

    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

    O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

    O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Arquivos de programas\COMODO\Firewall\cmdagent.exe

    O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)

    O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

    O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

    O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

    --

    End of file - 8196 bytes

    Compartilhar este post


    Link para o post
    Compartilhar em outros sites

    - Faça o download do Lop.com Uninstaller:

    http://lop.com/new_uninstall.exe

    • Desabilite o antivírus, pois ele pode reconhecer o arquivo como malware;
    • Feche o Internet Explorer, execute o programa e coloque os números, que irão aparecer, no campo em branco.

    - Gere novo log do HijackThis e cole na sua resposta.

    Compartilhar este post


    Link para o post
    Compartilhar em outros sites
  • Autor do tópico
  • Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 21:34:28, on 5/4/2008

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v7.00 (7.00.6000.16608)

    Boot mode: Normal

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Arquivos de programas\Lavasoft\Ad-Aware 2007\aawservice.exe

    C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

    C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\Arquivos de programas\COMODO\Firewall\cmdagent.exe

    C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

    C:\WINDOWS\system32\HPZipm12.exe

    C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Arquivos de programas\Messenger\msmsgs.exe

    C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

    C:\Arquivos de programas\Ares\Ares.exe

    C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

    C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

    C:\WINDOWS\system32\wuauclt.exe

    C:\WINDOWS\system32\wscntfy.exe

    C:\WINDOWS\explorer.exe

    C:\Arquivos de programas\Mozilla Firefox\firefox.exe

    C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

    O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll

    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar1.dll (file missing)

    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll (file missing)

    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar1.dll (file missing)

    O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Arquivos de programas\COMODO\Firewall\cfp.exe" -s

    O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

    O4 - HKCU\..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

    O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background

    O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

    O4 - HKCU\..\Run: [ares] "C:\Arquivos de programas\Ares\Ares.exe" -h

    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

    O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll

    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll

    O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

    O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab

    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab

    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab

    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

    O17 - HKLM\System\CCS\Services\Tcpip\..\{AD471B17-AAC7-4E49-B260-6B5E32C0B005}: NameServer = 200.143.64.10,201.35.68.130

    O17 - HKLM\System\CCS\Services\Tcpip\..\{B43880F5-6284-43D1-ADE3-10FAEF3AFCA6}: NameServer = 200.143.64.10,201.35.68.130

    O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll

    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Arquivos de programas\Lavasoft\Ad-Aware 2007\aawservice.exe

    O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Arquivos de programas\Ares Ultra\chatServer.exe

    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

    O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

    O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Arquivos de programas\COMODO\Firewall\cmdagent.exe

    O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)

    O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

    O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

    O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

    --

    End of file - 7764 bytes

    Compartilhar este post


    Link para o post
    Compartilhar em outros sites

    - Ok, o log está limpo :)

    - Recomendo uma manutenção no computador para exclusão dos arquivos temporários, desnecessários e entradas inválidas no registro. Faça o download do CCleaner:

    • Abra o programa e clique em Executar Limpeza;
    • Após isto, clique em Registro > Procurar erros > Corrigir erros selecionados

    - Desative e ative novamente a Restauração do Sistema

    - Leia o artigo Proteja seu PC para mais informações sobre como evitar infecções.

    Compartilhar este post


    Link para o post
    Compartilhar em outros sites
    Entre para seguir isso  





    Sobre o Clube do Hardware

    No ar desde 1996, o Clube do Hardware é uma das maiores, mais antigas e mais respeitadas publicações sobre tecnologia do Brasil. Leia mais

    Direitos autorais

    Não permitimos a cópia ou reprodução do conteúdo do nosso site, fórum, newsletters e redes sociais, mesmo citando-se a fonte. Leia mais

    ×