XP - Erro em ficheiro DLL.EXE

[Márcio Henriques]

Boas, preciso da vossa ajuda.

Tenho o XP professional SP1, após ter instalado net por cabo, decidi instalar anti-spyware´s e anti-virus (Avast).

Durante a instalação do anti-virus deu-me alerta de infecção e o pc bloqueou.

Não tinha cesso ao pc, pois este bloqueva logo apos entrar.

Com tempo la conseui limpar os virus, mas por estranho que parece deixei de ter acesso a algumas partes do XP.

Ex: quando entro no painel control e cliko no adicionar/remover programas aparece-me a seguinte mensagem: "Windows não consegue localizar rundll32.exe"e isso acontece noutras secções que tento aceder.

De resto esta a trabalhar bem e não acusa virus no Avast nem nos Anti-spyware´s.

Disseram-me que teria de formatar o pc.

Que terei realmente de fazer?

[JoseMelo]

- Baixe o programa HijackThis

- Crie uma nova pasta em C:\ e coloque o programa dentro dela;

- Abra o HijackThis, clique em Do a system scan and save a logfile;

- Copie o log salvo na pasta HijackThis e cole na sua resposta.

[Márcio Henriques]

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\System32\dfrgfat32.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\winsys.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Programas\Spybot - Search & Destroy\TeaTimer.exe

C:\Programas\MSN Messenger\msnmsgr.exe

C:\Programas\Internet Explorer\iexplore.exe

C:\Programas\Internet Explorer\iexplore.exe

C:\prog\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sapo.pt/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hiperligações

R3 - Default URLSearchHook is missing

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [MSN service] msmsgr.exe

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [Client Server Runtime Process] C:\WINDOWS\System32\csrs.exe

O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe

O4 - HKLM\..\Run: [Configuration Loader] scvhost.exe

O4 - HKLM\..\Run: [Micros0ft Updote] FmMPacK32.exe

O4 - HKLM\..\RunServices: [MSN service] msmsgr.exe

O4 - HKLM\..\RunServices: [Micros0ft Updote] FmMPacK32.exe

O4 - HKLM\..\RunServices: [Configuration Loader] scvhost.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Programas\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Programas\Messenger\msmsgs.exe" /background

O4 - Startup: PowerReg Scheduler.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programas\Ficheiros comuns\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Programas\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...608/mcfscan.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - Winlogon Notify: MCPClient - C:\PROGRA~1\FICHEI~1\Stardock\mcpstub.dll (file missing)

O23 - Service: Adobe LM Service - Unknown owner - C:\Programas\Ficheiros comuns\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - Unknown owner - C:\Programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programas\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Programas\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: Defragmentation Management Handler (FAT Defragmentation) - Unknown owner - C:\WINDOWS\System32\dfrgfat32.exe

O23 - Service: NetDDE Server (NetDDEsrv) - Unknown owner - C:\WINDOWS\System32\netddesrv.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: WindowsSysBoot - Unknown owner - C:\WINDOWS\winsys.exe

[Márcio Henriques]

e agora?....

[Márcio Henriques]

apos algumas pesquisas descobri isto:

Why do I receive a run32dll.exe error when I open Control Panel in Windows XP or Windows 2000?

You might receive such an error if the run32dll.exe file is corrupt or if a virus (e.g., W32/SirCam@MM) is present on your machine. To correct the error, begin by ensuring that you have an up-to-date virus checker and perform a full scan of your system. Next, to restore run32dll.exe, insert your XP or Win2K installation CD-ROM, then go to a command prompt and type

expand \i386\rundll32.ex_ %Systemroot%\rundll32.exe

to extract the version of the file to your system. After you extract the file, restart your machine.

[JoseMelo]

- Configure o computador para exibir todos os arquivos

- Faça o download do Killbox e execute-o.

Marque a opção Delete on Reboot. Em Full Path of File to Delete, coloque:

C:\WINDOWS\System32\dfrgfat32.exe

Clique no X e então clique em Sim e depois Não.

- Repita para os arquivos abaixo:

C:\WINDOWS\winsys.exe

C:\WINDOWS\System32\csrs.exe

C:\WINDOWS\System32\scvhost.exe

C:\WINDOWS\System32\msmsgr.exe

C:\WINDOWS\System32\FmMPacK32.exe

C:\WINDOWS\msmsgr.exe

C:\WINDOWS\scvhost.exe

- Copie o conteúdo deste post para o bloco de notas e reinicie o computador em modo seguro (pressione F8 durante a inicialização);

- Digite no Executar services.msc, localize o serviço WindowsSysBoot, dê um duplo clique e escolha Desativado. Clique também em Parar;

- Abra o HijackThis, clique em Open the Misc Tools section e em Delete an NT services..., coloque o serviço WindowsSysBoot e clique em Ok;

- Abra novamente o HijackThis, clique em Do a system scan only, marque as entradas abaixo e clique em Fix checked:

O4 - HKLM\..\Run: [MSN service] msmsgr.exe

O4 - HKLM\..\Run: [Client Server Runtime Process] C:\WINDOWS\System32\csrs.exe

O4 - HKLM\..\RunServices: [MSN service] msmsgr.exe

O4 - HKLM\..\RunServices: [Micros0ft Updote] FmMPacK32.exe

O4 - HKLM\..\RunServices: [Configuration Loader] scvhost.exe

- Reinicie em modo normal, gere novo log e cole na sua resposta.

[Márcio Henriques]

Depois de fazer isso tudo, aqui vai o log:

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Programas\Alwil Software\Avast4\ashWebSv.exe

C:\Programas\Alwil Software\Avast4\ashMaiSv.exe

C:\WINDOWS\System32\wuauclt.exe

C:\prog\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sapo.pt/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hiperligações

R3 - Default URLSearchHook is missing

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe

O4 - HKLM\..\Run: [Configuration Loader] scvhost.exe

O4 - HKLM\..\Run: [system service75] C:\WINDOWS\etb\pokapoka75.exe

O4 - HKLM\..\RunServices: [MSN service] msmsgr.exe

O4 - HKLM\..\RunServices: [Micros0ft Updote] FmMPacK32.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Programas\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Programas\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [Windows Microsoft Messenger] msnmsgs.exe

O4 - Startup: PowerReg Scheduler.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programas\Ficheiros comuns\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Programas\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...608/mcfscan.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - Winlogon Notify: MCPClient - C:\PROGRA~1\FICHEI~1\Stardock\mcpstub.dll (file missing)

O23 - Service: Adobe LM Service - Unknown owner - C:\Programas\Ficheiros comuns\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - Unknown owner - C:\Programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programas\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Programas\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: Defragmentation Management Handler (FAT Defragmentation) - Unknown owner - C:\WINDOWS\System32\dfrgfat32.exe (file missing)

O23 - Service: NetDDE Server (NetDDEsrv) - Unknown owner - C:\WINDOWS\System32\netddesrv.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

[JoseMelo]

- Abra o Bloco de notas, copie as linhas abaixo e salve como Delete.txt:

C:\WINDOWS\system32\scvhost.exe

C:\WINDOWS\system\scvhost.exe

C:\WINDOWS\scvhost.exe

C:\WINDOWS\etb\pokapoka75.exe

C:\WINDOWS\system32\msmsgr.exe

C:\WINDOWS\system\msmsgr.exe

C:\WINDOWS\msmsgr.exe

C:\WINDOWS\system32\FmMPacK32.exe

C:\WINDOWS\system\FmMPacK32.exe

C:\WINDOWS\FmMPacK32.exe

- Abra o Killbox, marque a opção Delete on Reboot, coloque Delete.txt, clique em File e em Paste From Clipboard, clique no X, em Sim e depois em Não;

- Copie o conteúdo deste post para o bloco de notas e reinicie o computador em modo seguro (pressione F8 durante a inicialização);

- Digite no Executar services.msc, localize os serviços Defragmentation Management Handler e NetDDE Server, dê um duplo clique e escolha Desativado. Clique também em Parar;

- Abra o HijackThis, clique em Open the Misc Tools section e em Delete an NT services..., coloque os serviços Defragmentation Management Handler e NetDDE Server e clique em Ok;

- Abra novamente o HijackThis, clique em Do a system scan only, marque as entradas abaixo e clique em Fix checked:

O4 - HKLM\..\Run: [Configuration Loader] scvhost.exe

O4 - HKLM\..\Run: [system service75] C:\WINDOWS\etb\pokapoka75.exe

O4 - HKLM\..\RunServices: [MSN service] msmsgr.exe

O4 - HKLM\..\RunServices: [Micros0ft Updote] FmMPacK32.exe

- Faça uma busca no PC e delete a pasta em destaque:

C:\WINDOWS\etb

- Reinicie em modo normal, gere novo log e cole na sua resposta.

[Márcio Henriques]

apenas n consegui localizar nenhuma pasta com o nome de "etb".

Nem pasta nem ficheiros com esse nome... de qualquer modo aqui vai o log.

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Programas\Spybot - Search & Destroy\TeaTimer.exe

C:\WINDOWS\System32\msnmsgs.exe

C:\Programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Programas\Alwil Software\Avast4\ashWebSv.exe

C:\Programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Programas\Internet Explorer\iexplore.exe

C:\WINDOWS\System32\wuauclt.exe

C:\prog\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sapo.pt/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hiperligações

R3 - Default URLSearchHook is missing

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe

O4 - HKLM\..\Run: [Windows Microsoft Messenger] msnmsgs.exe

O4 - HKLM\..\Run: [Client Server Runtime Process] C:\WINDOWS\System32\csrs.exe

O4 - HKLM\..\Run: [Configuration Loader] scvhost.exe

O4 - HKLM\..\Run: [system service75] C:\WINDOWS\etb\pokapoka75.exe

O4 - HKLM\..\RunServices: [MSN service] msmsgr.exe

O4 - HKLM\..\RunServices: [Micros0ft Updote] FmMPacK32.exe

O4 - HKLM\..\RunServices: [Windows Microsoft Messenger] msnmsgs.exe

O4 - HKLM\..\RunServices: [Configuration Loader] scvhost.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Programas\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Programas\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [Windows Microsoft Messenger] msnmsgs.exe

O4 - Startup: PowerReg Scheduler.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programas\Ficheiros comuns\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Programas\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...608/mcfscan.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - Winlogon Notify: MCPClient - C:\PROGRA~1\FICHEI~1\Stardock\mcpstub.dll (file missing)

O23 - Service: Adobe LM Service - Unknown owner - C:\Programas\Ficheiros comuns\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - Unknown owner - C:\Programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programas\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Programas\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

por ignorância minha cocloco a seguinte questão.. não haveria maneira de repor a pasta ou fixeiro danificado, atravers de copia de outro cd do XP? ou fazendo alguma actualização?

[JoseMelo]

- Abra o Killbox, marque a opção Delete on Reboot. Em Full Path of File to Delete, coloque:

C:\WINDOWS\System32\csrs.exe

lique no X e então clique em Sim e depois Não.

- Repita para o arquivo abaixo:

C:\WINDOWS\etb\pokapoka75.exe

- Reinicie o computador em modo seguro (pressione F8 durante a inicialização);

- Abra o HijackThis, clique em Do a system scan only, marque as entradas abaixo e clique em Fix checked:

O4 - HKLM\..\Run: [Windows Microsoft Messenger] msnmsgs.exe

O4 - HKLM\..\Run: [Client Server Runtime Process] C:\WINDOWS\System32\csrs.exe

O4 - HKLM\..\Run: [Configuration Loader] scvhost.exe

O4 - HKLM\..\Run: [system service75] C:\WINDOWS\etb\pokapoka75.exe

O4 - HKLM\..\RunServices: [MSN service] msmsgr.exe

O4 - HKLM\..\RunServices: [Micros0ft Updote] FmMPacK32.exe

O4 - HKLM\..\RunServices: [Windows Microsoft Messenger] msnmsgs.exe

O4 - HKLM\..\RunServices: [Configuration Loader] scvhost.exe

O4 - HKCU\..\Run: [Windows Microsoft Messenger] msnmsgs.exe

- Faça uma busca no PC, localize a pasta em destaque e delete:

C:\WINDOWS\etb

(Se você ativou a visualização de todos os arquivos (ficheiros) como indicado no início, a verá no diretório C:\WINDOWS;

- Reinicie em modo normal, gere novo log e cole na sua resposta.

[Márcio Henriques]

por estranho k pareça n tenho la essa pasta.

já confirmei as opções para ver as pastas ocultas e esta td bem.

apenas n encontro essa pasta

aqui vai o log:

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\System32\msnmsgs.exe

C:\Programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Programas\Alwil Software\Avast4\ashWebSv.exe

C:\Programas\Alwil Software\Avast4\ashMaiSv.exe

C:\WINDOWS\System32\wuauclt.exe

C:\prog\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sapo.pt/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hiperligações

R3 - Default URLSearchHook is missing

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe

O4 - HKLM\..\Run: [Windows Microsoft Messenger] msnmsgs.exe

O4 - HKLM\..\RunServices: [Windows Microsoft Messenger] msnmsgs.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Programas\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Programas\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [Windows Microsoft Messenger] msnmsgs.exe

O4 - Startup: PowerReg Scheduler.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programas\Ficheiros comuns\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Programas\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...608/mcfscan.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - Winlogon Notify: MCPClient - C:\PROGRA~1\FICHEI~1\Stardock\mcpstub.dll (file missing)

O23 - Service: Adobe LM Service - Unknown owner - C:\Programas\Ficheiros comuns\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - Unknown owner - C:\Programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programas\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Programas\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

[JoseMelo]

- Ok, a pasta deve ter sido deletada pelo Killbox;

- Abra o HijackThis, clique em Do a system scan only, marque as entradas abaixo e clique em Fix checked:

O4 - HKLM\..\Run: [Windows Microsoft Messenger] msnmsgs.exe

O4 - HKLM\..\RunServices: [Windows Microsoft Messenger] msnmsgs.exe

O4 - HKCU\..\Run: [Windows Microsoft Messenger] msnmsgs.exe

- Gere novo log e cole na sua resposta.

[Márcio Henriques]

log:

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Programas\Alwil Software\Avast4\ashWebSv.exe

C:\Programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Programas\Internet Explorer\iexplore.exe

C:\prog\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sapo.pt/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hiperligações

R3 - Default URLSearchHook is missing

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Programas\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Programas\Messenger\msmsgs.exe" /background

O4 - Startup: PowerReg Scheduler.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programas\Ficheiros comuns\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Programas\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...608/mcfscan.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - Winlogon Notify: MCPClient - C:\PROGRA~1\FICHEI~1\Stardock\mcpstub.dll (file missing)

O23 - Service: Adobe LM Service - Unknown owner - C:\Programas\Ficheiros comuns\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - Unknown owner - C:\Programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programas\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Programas\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

[JoseMelo]

- Ok, seu log está limpo;

- Desative e ative novamente a Restauração do Sistema. Abra o Painel de Controle > Sistema > Restauração do Sistema. Marque: Desativar a restauração do sistema, clique em Aplicar e Ok. Em seguida desmarque novamente a opção;

- Leia o artigo Proteja seu PC para mais informações sobre como evitar novas infecções.

[Márcio Henriques]

n dá..... Grrrrrrrrrr

[Márcio Henriques]

continua a dar a mesma mensagem de erro knd tento aceder aos menus dentro do painel control:

a mensagem é:

"o windows não consegue localizar "rundll32.exe". Certifique-se de que escreveu o nome correctamente e, em seguida, tente de novo. Para procurar um ficheiro, clique no botao "iniciar" e, em seguida, clique em procurar".

[JoseMelo]

Faça o download da dll no link abaixo e copie para a pasta System32:

http://www.dll-files.com/dllindex/dll-files.shtml?run32

[Márcio Henriques]

já copiei.. mas nada!

que droga!

eu tenho o cd do xpsp1 e outro com sp2 .. n havera maneira de restaurar o sistema?

[JoseMelo]

- Insira o CD do XP no drive e clique em Instalar. Será feita a reinstalação. Antes faça uma cópia de Meus Documentos.

[Márcio Henriques]

valeu pela ajuda..

mas acabei por formatar o pc.....

valeu!