Ir ao conteúdo
  • Cadastre-se
Entre para seguir isso  
serginhosnake

log

Recommended Posts

Logfile of HijackThis v1.99.1

Scan saved at 18:10:29, on 11/1/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

D:\WINDOWS\System32\smss.exe

D:\WINDOWS\system32\winlogon.exe

D:\WINDOWS\system32\services.exe

D:\WINDOWS\system32\lsass.exe

D:\WINDOWS\system32\svchost.exe

D:\WINDOWS\System32\svchost.exe

D:\WINDOWS\system32\LEXBCES.EXE

D:\WINDOWS\system32\LEXPPS.EXE

D:\WINDOWS\system32\spoolsv.exe

D:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe

D:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe

D:\WINDOWS\system32\svchost.exe

D:\WINDOWS\explorer.exe

D:\ARQUIV~1\Grisoft\AVGFRE~1\avgcc.exe

D:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe

C:\Program Files\ASUS\Probe\AsusProb.exe

D:\Arquivos de programas\Winamp\winampa.exe

D:\WINDOWS\system32\LXSUPMON.EXE

D:\Arquivos de programas\Java\jre1.5.0_05\bin\jusched.exe

D:\WINDOWS\system32\wscntfy.exe

D:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE

D:\Documents and Settings\SERGIO\Desktop\hiza\HijackThis.exe

F2 - REG:system.ini: Shell=explorer.exe "D:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Web Folders\ibm00001.exe"

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - D:\Arquivos de programas\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\arquivos de programas\google\googletoolbar2.dll

O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Arquivos de programas\MSN Apps\MSN Toolbar\01.02.4000.1001\pt-br\msntb.dll

O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - D:\WINDOWS\Downloaded Program Files\gbieh.dll

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Arquivos de programas\MSN Apps\MSN Toolbar\01.02.4000.1001\pt-br\msntb.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\arquivos de programas\google\googletoolbar2.dll

O4 - HKLM\..\Run: [AVG7_CC] D:\ARQUIV~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [AVG7_EMC] D:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe

O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe

O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [WinampAgent] D:\Arquivos de programas\Winamp\winampa.exe

O4 - HKLM\..\Run: [LXSUPMON] D:\WINDOWS\system32\LXSUPMON.EXE RUN

O4 - HKLM\..\Run: [sunJavaUpdateSched] D:\Arquivos de programas\Java\jre1.5.0_05\bin\jusched.exe

O4 - HKLM\..\Run: [Windows Update] D:\WINDOWS\wupdmgr.exe

O4 - HKLM\..\Run: [system32] D:\WINDOWS\system32\system32.exe

O4 - Global Startup: Microsoft Office.lnk = D:\Arquivos de programas\Microsoft Office\Office\OSA9.EXE

O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: &Google Search - res://d:\arquivos de programas\google\GoogleToolbar2.dll/cmsearch.html

O8 - Extra context menu item: &Translate English Word - res://d:\arquivos de programas\google\GoogleToolbar2.dll/cmwordtrans.html

O8 - Extra context menu item: Backward Links - res://d:\arquivos de programas\google\GoogleToolbar2.dll/cmbacklinks.html

O8 - Extra context menu item: Cached Snapshot of Page - res://d:\arquivos de programas\google\GoogleToolbar2.dll/cmcache.html

O8 - Extra context menu item: Similar Pages - res://d:\arquivos de programas\google\GoogleToolbar2.dll/cmsimilar.html

O8 - Extra context menu item: Translate Page into English - res://d:\arquivos de programas\google\GoogleToolbar2.dll/cmtrans.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Arquivos de programas\Java\jre1.5.0_05\bin\npjpi150_05.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Arquivos de programas\Java\jre1.5.0_05\bin\npjpi150_05.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {7D731A83-6C80-4EA4-9646-5E06A0513274} (Sandlot Loader Control) - http://www.shockwave.com/content/ballistik/slgwebinstall.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab

O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399F83} (GbPluginObj Class) - https://www14.bancobrasil.com.br/plugin/GbPluginBb.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{403533CE-7317-43A3-A1AB-EAC799D3240F}: NameServer = 200.203.207.69,200.203.207.71

O17 - HKLM\System\CS1\Services\Tcpip\..\{403533CE-7317-43A3-A1AB-EAC799D3240F}: NameServer = 200.203.207.69,200.203.207.71

O17 - HKLM\System\CS2\Services\Tcpip\..\{403533CE-7317-43A3-A1AB-EAC799D3240F}: NameServer = 200.203.207.69,200.203.207.71

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\ARQUIV~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - Winlogon Notify: msctl32.dll - D:\WINDOWS\

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINDOWS\system32\LEXBCES.EXE

Compartilhar este post


Link para o post
Compartilhar em outros sites

- Faça o download do fix abaixo mas não o execute ainda:

http://linhadefensiva.uol.com.br/files/reg/desk-fix.reg

- Faça o download do Killbox e execute-o.

Marque a opção Delete on Reboot. Copie a abaixo para área de transferência (selecione e clique em Editar > Copiar ou pressione Ctrl + C).

D:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Web Folders\ibm00001.exe

D:\WINDOWS\wupdmgr.exe

D:\WINDOWS\system32\system32.exe

  • Volte ao KillBox. Clique em File > Paste from clipboard. Clique no botão All Files.
  • Clique no X. Responda Não à pergunta.

- Reinicie o computador em modo seguro (pressione F8 durante a inicialização);

- Abra o HijackThis, clique em Do a system scan only, marque as entradas abaixo e clique em Fix checked:

F2 - REG:system.ini: Shell=explorer.exe "D:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Web Folders\ibm00001.exe"

O4 - HKLM\..\Run: [Windows Update] D:\WINDOWS\wupdmgr.exe

O4 - HKLM\..\Run: [system32] D:\WINDOWS\system32\system32.exe

O20 - Winlogon Notify: msctl32.dll - D:\WINDOWS\

- Dê um duplo clique no arquivo .reg que baixou, e clique em Sim;

- Reinicie em modo normal, gere novo log e cole na sua resposta.

Compartilhar este post


Link para o post
Compartilhar em outros sites

Problema totalmente resolvido.

agradeço a sua ajuda

valeu josemelo......

Logfile of HijackThis v1.99.1

Scan saved at 18:52:26, on 11/1/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

D:\WINDOWS\System32\smss.exe

D:\WINDOWS\system32\winlogon.exe

D:\WINDOWS\system32\services.exe

D:\WINDOWS\system32\lsass.exe

D:\WINDOWS\system32\svchost.exe

D:\WINDOWS\System32\svchost.exe

D:\WINDOWS\system32\LEXBCES.EXE

D:\WINDOWS\system32\LEXPPS.EXE

D:\WINDOWS\system32\spoolsv.exe

D:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe

D:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe

D:\WINDOWS\Explorer.EXE

D:\WINDOWS\system32\svchost.exe

D:\ARQUIV~1\Grisoft\AVGFRE~1\avgcc.exe

D:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe

C:\Program Files\ASUS\Probe\AsusProb.exe

D:\Arquivos de programas\Winamp\winampa.exe

D:\WINDOWS\system32\LXSUPMON.EXE

D:\Arquivos de programas\Java\jre1.5.0_05\bin\jusched.exe

D:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe

D:\WINDOWS\system32\wscntfy.exe

D:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE

D:\WINDOWS\system32\wuauclt.exe

D:\Documents and Settings\SERGIO\Desktop\hiza\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - D:\Arquivos de programas\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\arquivos de programas\google\googletoolbar2.dll

O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Arquivos de programas\MSN Apps\MSN Toolbar\01.02.4000.1001\pt-br\msntb.dll

O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - D:\WINDOWS\Downloaded Program Files\gbieh.dll

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Arquivos de programas\MSN Apps\MSN Toolbar\01.02.4000.1001\pt-br\msntb.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\arquivos de programas\google\googletoolbar2.dll

O4 - HKLM\..\Run: [AVG7_CC] D:\ARQUIV~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [AVG7_EMC] D:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe

O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe

O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [WinampAgent] D:\Arquivos de programas\Winamp\winampa.exe

O4 - HKLM\..\Run: [LXSUPMON] D:\WINDOWS\system32\LXSUPMON.EXE RUN

O4 - HKLM\..\Run: [sunJavaUpdateSched] D:\Arquivos de programas\Java\jre1.5.0_05\bin\jusched.exe

O4 - Global Startup: Microsoft Office.lnk = D:\Arquivos de programas\Microsoft Office\Office\OSA9.EXE

O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: &Google Search - res://d:\arquivos de programas\google\GoogleToolbar2.dll/cmsearch.html

O8 - Extra context menu item: &Translate English Word - res://d:\arquivos de programas\google\GoogleToolbar2.dll/cmwordtrans.html

O8 - Extra context menu item: Backward Links - res://d:\arquivos de programas\google\GoogleToolbar2.dll/cmbacklinks.html

O8 - Extra context menu item: Cached Snapshot of Page - res://d:\arquivos de programas\google\GoogleToolbar2.dll/cmcache.html

O8 - Extra context menu item: Similar Pages - res://d:\arquivos de programas\google\GoogleToolbar2.dll/cmsimilar.html

O8 - Extra context menu item: Translate Page into English - res://d:\arquivos de programas\google\GoogleToolbar2.dll/cmtrans.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Arquivos de programas\Java\jre1.5.0_05\bin\npjpi150_05.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Arquivos de programas\Java\jre1.5.0_05\bin\npjpi150_05.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {7D731A83-6C80-4EA4-9646-5E06A0513274} (Sandlot Loader Control) - http://www.shockwave.com/content/ballistik/slgwebinstall.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab

O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399F83} (GbPluginObj Class) - https://www14.bancobrasil.com.br/plugin/GbPluginBb.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{403533CE-7317-43A3-A1AB-EAC799D3240F}: NameServer = 200.203.207.69,200.203.207.71

O17 - HKLM\System\CS1\Services\Tcpip\..\{403533CE-7317-43A3-A1AB-EAC799D3240F}: NameServer = 200.203.207.69,200.203.207.71

O17 - HKLM\System\CS2\Services\Tcpip\..\{403533CE-7317-43A3-A1AB-EAC799D3240F}: NameServer = 200.203.207.69,200.203.207.71

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\ARQUIV~1\MSNMES~1\msgrapp.dll" (file missing)

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINDOWS\system32\LEXBCES.EXE

Compartilhar este post


Link para o post
Compartilhar em outros sites

- Ok, o log está limpo;

- Desative e ative novamente a Restauração do Sistema. Abra o Painel de Controle > Sistema > Restauração do Sistema. Marque: Desativar a restauração do sistema, clique em Aplicar e Ok. Em seguida desmarque novamente a opção;

- Leia o artigo Proteja seu PC para mais informações sobre como evitar infecções.

Compartilhar este post


Link para o post
Compartilhar em outros sites
Entre para seguir isso  





Sobre o Clube do Hardware

No ar desde 1996, o Clube do Hardware é uma das maiores, mais antigas e mais respeitadas publicações sobre tecnologia do Brasil. Leia mais

Direitos autorais

Não permitimos a cópia ou reprodução do conteúdo do nosso site, fórum, newsletters e redes sociais, mesmo citando-se a fonte. Leia mais

×