[me ajudem a remover]

CONTINUA COM O VIRUS SEGUE O LOG DO COMBOFIX

ComboFix 10-01-19.04 - Inova 20/01/2010 7:57.1.2 - x86

Microsoft Windows 7 Ultimate 6.1.7600.0.1252.55.1046.18.1015.268 [GMT -2:00]

Executando de: c:\users\Inova\Desktop\ComboFix.exe

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

D:\anoataly.exe

D:\cs6phv6d.exe

D:\e9naq.exe

D:\h0.exe

D:\wisf1.exe

E:\anoataly.exe

E:\cs6phv6d.exe

E:\e9naq.exe

E:\h0.exe

E:\wisf1.exe

.

(((((((((((((((( Arquivos/Ficheiros criados de 2009-12-20 to 2010-01-20 ))))))))))))))))))))))))))))

.

2010-01-19 16:17 . 2010-01-19 16:17 -------- d-----w- c:\users\Inova\AppData\Roaming\Lingoes

2010-01-19 16:17 . 2010-01-19 16:17 -------- d-----w- c:\users\Inova\AppData\Local\Lingoes

2010-01-19 16:16 . 2010-01-19 16:16 -------- d-----w- c:\programdata\Lingoes

2010-01-19 15:57 . 2010-01-19 15:57 -------- d-----w- c:\programdata\NCH Software

2010-01-18 18:13 . 2010-01-18 18:13 -------- d-----w- c:\users\Inova\AppData\Roaming\AdobeUM

2010-01-18 18:12 . 2010-01-18 18:13 -------- d-----w- c:\users\Inova\AppData\Local\Adobe

2010-01-18 18:12 . 2010-01-18 18:12 -------- d-----w- c:\program files\Common Files\Adobe

2010-01-16 11:56 . 2010-01-16 11:57 -------- d-----w- C:\Storage Card

2010-01-16 10:37 . 2010-01-16 10:37 -------- d-----w- c:\users\Inova\AppData\Local\Ahead

2010-01-15 19:41 . 2010-01-20 10:02 -------- d-----w- c:\users\Inova\AppData\Roaming\skypePM

2010-01-15 19:41 . 2008-12-11 18:02 417792 ----a-w- c:\windows\system32\GDS32.DLL

2010-01-15 19:41 . 2010-01-15 19:41 -------- d-----w- c:\program files\Firebird

2010-01-15 19:39 . 2008-12-11 18:02 417792 ----a-w- c:\windows\system32\fbclient.dll

2010-01-15 19:39 . 2007-09-27 00:21 401920 ----a-w- c:\windows\system32\DesinstalaFinanceiro.exe

2010-01-15 19:39 . 2004-02-27 14:02 124416 ----a-w- c:\windows\system32\DBExpint.dll

2010-01-15 19:39 . 2002-08-09 14:00 296448 ----a-w- c:\windows\system32\Midas.dll

2010-01-15 19:39 . 2002-08-09 11:00 22528 ----a-w- c:\windows\system32\Borlndmm.dll

2010-01-15 19:39 . 2010-01-15 19:39 -------- d-----w- C:\Info Livre

2010-01-15 19:39 . 2010-01-20 10:02 -------- d-----w- c:\users\Inova\AppData\Roaming\Skype

2010-01-15 19:33 . 2010-01-15 19:33 -------- d-----w- c:\program files\Common Files\Skype

2010-01-15 19:33 . 2010-01-15 19:35 -------- d-----r- c:\program files\Skype

2010-01-15 19:32 . 2010-01-15 19:33 -------- d-----w- c:\programdata\Skype

2010-01-15 18:58 . 2010-01-15 19:14 -------- d-----w- c:\users\Inova\AppData\Local\Microsoft Games

2010-01-15 18:19 . 2010-01-15 18:19 -------- d-----w- c:\users\Inova\AppData\Roaming\Nero

2010-01-15 17:35 . 2010-01-15 16:43 -------- d-----w- c:\windows\Panther

2010-01-15 17:35 . 2010-01-15 17:35 -------- d-----w- C:\Boot

2010-01-15 17:26 . 2010-01-15 17:27 -------- d-----w- c:\program files\Common Files\Nero

2010-01-15 17:26 . 2010-01-15 17:26 -------- d-----w- c:\programdata\Nero

2010-01-15 17:26 . 2010-01-15 17:26 -------- d-----w- c:\program files\Nero

2010-01-15 17:17 . 2010-01-20 09:39 -------- d-----w- c:\users\Inova\Tracing

2010-01-15 17:14 . 2010-01-15 17:14 -------- d-----w- c:\program files\Microsoft Silverlight

2010-01-15 17:13 . 2010-01-15 17:13 -------- d-----w- c:\program files\Microsoft Office Outlook Connector

2010-01-15 17:13 . 2010-01-15 17:13 -------- d-----w- c:\program files\Microsoft Sync Framework

2010-01-15 17:12 . 2006-11-29 15:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll

2010-01-15 17:12 . 2010-01-15 17:12 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition

2010-01-15 17:11 . 2010-01-15 17:13 -------- d-----w- c:\program files\Microsoft

2010-01-15 17:10 . 2010-01-15 17:10 -------- d-----w- c:\program files\Windows Live SkyDrive

2010-01-15 17:10 . 2010-01-15 17:13 -------- d-----w- c:\program files\Windows Live

2010-01-15 17:08 . 2010-01-15 17:08 -------- d-----w- c:\program files\Common Files\Windows Live

2010-01-15 17:08 . 2010-01-15 17:08 -------- d-----w- c:\program files\CCleaner

2010-01-15 17:04 . 2010-01-19 17:14 109216 ----a-w- c:\users\Inova\AppData\Local\GDIPFONTCACHEV1.DAT

2010-01-15 17:03 . 2009-11-02 22:42 195456 ------w- c:\windows\system32\MpSigStub.exe

2010-01-15 17:03 . 2010-01-15 17:03 -------- d-----w- c:\programdata\DVD Shrink

2010-01-15 17:03 . 2010-01-15 17:03 -------- d-----w- c:\program files\DVD Shrink

2010-01-15 17:02 . 2010-01-15 17:02 -------- d-----w- c:\users\Inova\AppData\Local\Mozilla

2010-01-15 16:57 . 2006-10-26 21:56 33104 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll

2010-01-15 16:57 . 2006-10-26 21:56 32592 ----a-w- c:\windows\system32\msonpmon.dll

2010-01-15 16:56 . 2010-01-15 16:56 -------- d-----w- c:\program files\Microsoft Works

2010-01-15 16:55 . 2010-01-15 16:55 -------- d-----w- c:\windows\PCHEALTH

2010-01-15 16:55 . 2010-01-15 16:55 -------- d-----w- c:\program files\Microsoft.NET

2010-01-15 16:54 . 2010-01-15 16:54 -------- d-----w- c:\program files\Microsoft Visual Studio 8

2010-01-15 16:53 . 2010-01-15 16:53 -------- d-----w- c:\users\Inova\AppData\Local\Microsoft Help

2010-01-15 16:53 . 2010-01-15 16:57 -------- d-----w- c:\programdata\Microsoft Help

2010-01-15 16:52 . 2010-01-15 16:52 -------- d-----r- C:\MSOCache

2010-01-15 16:51 . 2010-01-15 16:51 -------- d-----w- c:\windows\system32\Macromed

2010-01-15 16:51 . 2009-10-11 06:17 411368 ----a-w- c:\windows\system32\deploytk.dll

2010-01-15 16:51 . 2010-01-15 17:49 -------- d-----w- c:\program files\Java

2010-01-15 16:51 . 2010-01-18 18:12 -------- d-sh--w- c:\windows\Installer

2010-01-15 16:46 . 2010-01-20 09:43 -------- d-----w- c:\windows\system32\wbem\Performance

2010-01-15 16:43 . 2010-01-15 16:43 -------- d-----w- C:\Recovery

2010-01-15 16:38 . 2010-01-15 16:38 -------- d-----w- c:\programdata\Hewlett-Packard

2010-01-15 16:38 . 2009-07-14 01:15 280064 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\hpzppw71.dll

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-01-20 09:43 . 2009-07-14 08:31 654272 ----a-w- c:\windows\system32\prfh0416.dat

2010-01-20 09:43 . 2009-07-14 08:31 124724 ----a-w- c:\windows\system32\prfc0416.dat

2010-01-15 19:41 . 2010-01-15 19:41 56 ---há-w- c:\programdata\ezsidmv.dat

2010-01-15 16:56 . 2009-07-14 04:52 -------- d-----w- c:\program files\MSBuild

2010-01-15 16:50 . 2010-01-15 16:50 -------- d-----w- c:\program files\Marcos Velasco Security

2010-01-15 16:50 . 2010-01-15 16:50 -------- d-----w- c:\program files\K-Lite Codec Pack

2010-01-15 16:44 . 2010-01-15 16:44 0 ---há-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf

2010-01-15 16:43 . 2010-01-15 16:43 -------- d-sh--we c:\programdata\Modelos

2010-01-15 16:43 . 2010-01-15 16:43 -------- d-sh--we c:\programdata\Menu Iniciar

2010-01-15 16:43 . 2010-01-15 16:43 -------- d-sh--we c:\programdata\Favoritos

2010-01-15 16:43 . 2010-01-15 16:43 -------- d-sh--we c:\programdata\Documentos

2010-01-15 16:43 . 2010-01-15 16:43 -------- d-sh--we c:\programdata\Dados de aplicativos

2010-01-15 16:43 . 2010-01-15 16:43 -------- d-sh--we c:\program files\Common Files\Sistema

2010-01-15 16:43 . 2010-01-15 16:43 -------- d-sh--we c:\program files\Arquivos Comuns

2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat

2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]

"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-10 2221352]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\System32\drivers\Rt86win7.sys [10/06/2009 19:18 139776]

S2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\Firebird\Firebird_2_0\bin\fbguard.exe -s --> c:\program files\Firebird\Firebird_2_0\bin\fbguard.exe -s [?]

S3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\Firebird\Firebird_2_0\bin\fbserver.exe -s --> c:\program files\Firebird\Firebird_2_0\bin\fbserver.exe -s [?]

.

.

------- Scan Suplementar -------

.

uStart Page = hxxp://www.lagoacred.com.br/

IE: E&xportar para o Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

TCP: {C2E3B710-325F-4E5E-9002-D11F6421FCAD} = 200.165.132.151,200.165.132.148

FF - ProfilePath - c:\users\Inova\AppData\Roaming\Mozilla\Firefox\Profiles\6dugicfq.default\

FF - prefs.js: browser.startup.homepage - www.google.com.br

FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll

FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll

FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

.

.

--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Tempo para conclusão: 2010-01-20 08:03:42

ComboFix-quarantined-files.txt 2010-01-20 10:03

Pré-execução: 13.013.704.704 bytes disponíveis

Pós execução: 12.954.947.584 bytes disponíveis

- - End Of File - - 75E9EDD9ED946AB0B70AE846C423E986

[me ajudem a remover]

SEGUE O LOG DO PC

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:19:53, on 20/01/2010

Platform: Unknown Windows (WinNT 6.01.3504)

MSIE: Internet Explorer v8.00 (8.00.7600.16385)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\Program Files\Windows Live\Contacts\wlcomm.exe

C:\Program Files\Windows Live\Mail\wlmail.exe

C:\Windows\system32\NOTEPAD.EXE

C:\Program Files\AVG\AVG9\avgscanx.exe

C:\Windows\system32\conhost.exe

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\Program Files\AVG\AVG9\avgui.exe

C:\Info Livre\FinanceiroIB\GerenciadorFIL.exe

C:\Windows\system32\NOTEPAD.EXE

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Users\Inova\Desktop\REMOVER\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.lagoacred.com.br/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Incluir no Blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Incluir no Blog no Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/shock...ash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{C2E3B710-325F-4E5E-9002-D11F6421FCAD}: NameServer = 200.165.132.151,200.165.132.148

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GRA32A~1.DLL

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: avgrsstx.dll

O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe

O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - FirebirdSQL Project - C:\Program Files\Firebird\Firebird_2_0\bin\fbguard.exe

O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - FirebirdSQL Project - C:\Program Files\Firebird\Firebird_2_0\bin\fbserver.exe

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe

--

End of file - 5549 bytes