[Resolvido]Vários problemas no PC! vários trojans! :/

tetheu · Fevereiro 12, 2008

olá, estou tendo mtos problemas com virus e trojans aki no pc, não to conseguindo remove-los...

amvo0.dll é um exemplo e ainda tem outros...

por favor me ajudem... segue o log.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 14:00:37, on 12/2/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe

C:\windows\system32\qttask.exe

C:\Arquivos de programas\Java\jre1.5.0_06\bin\jusched.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\Arquivos de programas\Real\RealPlayer\RealPlay.exe

C:\Documents and Settings\Matheus\Desktop\VundoFix.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\ARQUIV~1\MOZILL~1\FIREFOX.EXE

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Arquivos de programas\Windows Live\Messenger\usnsvc.exe

C:\Arquivos de programas\Alwil Software\Avast4\setup\avast.setup

C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.brasiltelecom.com.br/

R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Arquivos de programas\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL (file missing)

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\ARQUIV~1\MEGAUP~1\MEGAUP~1.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\ARQUIV~1\MEGAUP~1\MEGAUP~1.DLL

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [QuickTime Task] "C:\windows\system32\qttask.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Arquivos de programas\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [Ping upload extra road] C:\Documents and Settings\All Users\Dados de aplicativos\burn spam ping upload\about boob.exe

O4 - HKCU\..\Run: [bold axis] C:\DOCUME~1\Matheus\DADOSD~1\HEARTS~1\tool style.exe

O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Arquivos de programas\MSN Messenger\msnmsgr.exe" /background (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Arquivos de programas\MSN Messenger\msnmsgr.exe" /background (User 'Default user')

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office\OSA9.EXE

O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Arquivos de programas\MP3 Player Utilities 3.75\AMVConverter\grab.html

O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Arquivos de programas\MP3 Player Utilities 3.75\MediaManager\grab.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Arquivos de programas\Internet Explorer\Plugins\NPDocBox.dll

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {33331111-1111-1111-1111-611111193423} -

O16 - DPF: {33331111-1111-1111-1111-611111193429} -

O16 - DPF: {33331111-1111-1111-1111-615111193427} -

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.MSN.com/binary/MineS...er.cab56986.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{64C16A2C-8785-489B-92C4-C29104CEFF49}: NameServer = 201.10.128.2 201.10.120.2

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)

--

End of file - 6269 bytes

desde já agradeço

JackSSA · Fevereiro 12, 2008

Baixe o ComboFix e salve no desktop.

Feche todas as janelas e programas.

Dê um duplo-clique no combofix.exe e tecle "1" em seguida Enter para prosseguir o Fix. Vai durar uma média de 10 minutos.

O ComboFix reiniciará o PC automaticamente para completar o processo de remoção.

Quando acabar, será gerado um log, que vai estar em C:\ComboFix.txt.

Atenção:

Não clique na Janela do ComboFix, nem o feche clicando no X, enquanto estiver rodando, pois senão irá parar e seu desktop ficará em branco.

Para parar ou sair do ComboFix, tecle "2" e Enter.

Depois gere um novo log com o HijackThis e poste, juntamente com o ComboFix.txt.

tetheu · Fevereiro 13, 2008

JackSSA · Fevereiro 13, 2008

Delete a pasta qoobox que está localizada em C:\, delete também o log ComboFix.txt também localizado em C:\.

Sugiro que imprima ou salve os procedimentos abaixo, e não use a internet até terminado o procedimento.

Selecione e copie o texto dentro do QUOTE (caixa cinza) abaixo. Abra o Bloco de notas e cole o que copiou. Salve então, na área de trabalho, com o nome de CFScript.txt.

File::
C:\2ifetri.cmd
C:\h.cmd
C:\xn1i9x.com
C:\DOCUME~1\Matheus\DADOSD~1\HEARTS~1\tool style.exe
C:\Documents and Settings\All Users\Dados de aplicativos\burn spam ping upload\about boob.exe
C:\ntde1ect.com
D:\ntde1ect.com
G:\uxdeiect.com
G:\xn1i9x.com
G:\ntde1ect.com
H:\ntde1ect.com
C:\WINDOWS\Tasks\AAE74D989190FE94.job
c:\docume~1\matheus\dadosd~1\hearts~1\Body Manager 4.exe
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Bold axis"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ping upload extra road"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3f6a6889-5978-11db-9c76-000ae6439822}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{490cf373-3c11-11db-9be4-000ae6439822}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{869d374c-9111-11db-9d25-000ae6439822}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b51860e1-6530-11db-9c94-000ae6439822}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cc6133f6-580b-11dc-a01c-000ae6439822}]

Arraste agora o CFScript.txt para o ComboFix conforme a demonstração abaixo.

O ComboFix irá rodar e reiniciará o PC automaticamente para completar o processo de remoção.

IMPORTANTE: Não use o mouse nem o teclado quando o ComboFix estiver rodando.

Quando acabar, será gerado um log, que estará em C:\ComboFix.txt.

Poste o novo Log ComboFix.txt à sua resposta.

Poste também um novo Log do Hijackthis.

Imagem By sUBs.

tetheu · Fevereiro 13, 2008

Segue o NOVO log do combofix e do hijack respectivamente!

ComboFix 08-02-13.2 - Matheus 2008-02-14 20:47:41.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.70 [GMT -2:00]

Executando de: C:\Documents and Settings\Matheus\Desktop\ComboFix.exe

Command switches used :: C:\Documents and Settings\Matheus\Desktop\CFScript.txt

* Criado um novo ponto de restauro

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE

C:\2ifetri.cmd

c:\docume~1\matheus\dadosd~1\hearts~1\Body Manager 4.exe

C:\DOCUME~1\Matheus\DADOSD~1\HEARTS~1\tool style.exe

C:\Documents and Settings\All Users\Dados de aplicativos\burn spam ping upload\about boob.exe

C:\h.cmd

C:\ntde1ect.com

C:\WINDOWS\Tasks\AAE74D989190FE94.job

C:\xn1i9x.com

D:\ntde1ect.com

G:\ntde1ect.com

G:\uxdeiect.com

G:\xn1i9x.com

H:\ntde1ect.com

.

((((((((((((((((((((((((((((((((((((( Outras Exclusäes )))))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Documents and Settings\All Users\Dados de aplicativos\burn spam ping upload\about boob.exe

C:\2ifetri.cmd

c:\docume~1\matheus\dadosd~1\hearts~1\Body Manager 4.exe

C:\DOCUME~1\Matheus\DADOSD~1\HEARTS~1\tool style.exe

C:\Documents and Settings\All Users\Dados de aplicativos\burn spam ping upload\about boob.exe

C:\h.cmd

C:\WINDOWS\Tasks\AAE74D989190FE94.job

C:\xn1i9x.com

.

((((((((((((((((((((((( Ficheiros criados de 2008-01-14 to 2008-02-14 ))))))))))))))))))))))))))))))))

.

2008-02-13 22:08 . 2008-02-14 20:50 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\Configurações locais

2008-02-13 22:08 . 2008-02-14 20:50 <DIR> d-------- C:\Documents and Settings\NetworkService\Configurações locais

2008-02-13 22:08 . 2008-02-14 20:50 <DIR> d-------- C:\Documents and Settings\Matheus\Configurações locais

2008-02-13 22:08 . 2008-02-14 20:50 <DIR> d-------- C:\Documents and Settings\Marcelo\Configurações locais

2008-02-13 22:08 . 2008-02-14 20:50 <DIR> d-------- C:\Documents and Settings\Marcela\Configurações locais

2008-02-13 22:08 . 2008-02-14 20:50 <DIR> d-------- C:\Documents and Settings\LocalService\Configurações locais

2008-02-13 22:08 . 2008-02-14 20:50 <DIR> d-------- C:\Documents and Settings\Default User\Configurações locais

2008-02-13 22:08 . 2008-02-14 20:50 <DIR> d-------- C:\Documents and Settings\Agnes\Configurações locais

2008-02-11 21:55 . 2008-02-11 21:55 <DIR> d-------- C:\VundoFix Backups

2008-02-11 14:49 . 2008-02-11 14:49 <DIR> d-------- C:\Documents and Settings\Administrador\Dados de aplicativos\Talkback

2008-02-10 18:25 . 2008-02-10 18:25 268 --ah----- C:\sqmdata10.sqm

2008-02-10 18:25 . 2008-02-10 18:25 244 --ah----- C:\sqmnoopt10.sqm

2008-02-08 11:51 . 2008-02-08 11:51 268 --ah----- C:\sqmdata09.sqm

2008-02-08 11:51 . 2008-02-08 11:51 244 --ah----- C:\sqmnoopt09.sqm

2008-02-07 23:55 . 2008-02-07 23:55 268 --ah----- C:\sqmdata08.sqm

2008-02-07 23:55 . 2008-02-07 23:55 244 --ah----- C:\sqmnoopt08.sqm

2008-02-07 19:18 . 2008-02-07 19:18 268 --ah----- C:\sqmdata07.sqm

2008-02-07 19:18 . 2008-02-07 19:18 244 --ah----- C:\sqmnoopt07.sqm

2008-02-03 19:48 . 2008-02-03 19:48 268 --ah----- C:\sqmdata06.sqm

2008-02-03 19:48 . 2008-02-03 19:48 244 --ah----- C:\sqmnoopt06.sqm

2008-01-24 23:14 . 2008-01-24 23:14 268 --ah----- C:\sqmdata05.sqm

2008-01-24 23:14 . 2008-01-24 23:14 244 --ah----- C:\sqmnoopt05.sqm

2008-01-23 22:48 . 2008-01-23 22:48 268 --ah----- C:\sqmdata03.sqm

2008-01-23 22:48 . 2008-01-23 22:48 244 --ah----- C:\sqmnoopt03.sqm

2008-01-23 22:48 . 2008-01-23 22:48 208 --ah----- C:\sqmdata04.sqm

2008-01-23 22:48 . 2008-01-23 22:48 172 --ah----- C:\sqmnoopt04.sqm

2008-01-22 23:35 . 2008-01-22 23:35 268 --ah----- C:\sqmdata02.sqm

2008-01-22 23:35 . 2008-01-22 23:35 244 --ah----- C:\sqmnoopt02.sqm

2008-01-16 13:55 . 2008-01-16 13:55 268 --ah----- C:\sqmdata00.sqm

2008-01-16 13:55 . 2008-01-16 13:55 244 --ah----- C:\sqmnoopt00.sqm

2008-01-16 13:55 . 2008-01-16 13:55 172 --ah----- C:\sqmnoopt01.sqm

2008-01-16 13:55 . 2008-01-16 13:55 172 --ah----- C:\sqmdata01.sqm

2008-01-16 11:44 . 2008-02-14 20:50 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\burn spam ping upload

2008-01-16 11:43 . 2008-01-16 11:43 <DIR> d-------- C:\Arquivos de programas\Heart save build

2008-01-16 11:42 . 2008-01-16 11:42 <DIR> d-------- C:\Arquivos de programas\Circle Developement

.

((((((((((((((((((((((((((((((((((((( Relat¢rio Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-02-14 22:48 --------- d-----w C:\Documents and Settings\Matheus\Dados de aplicativos\Heart save build

2008-02-14 19:26 --------- d-----w C:\Documents and Settings\Marcela\Dados de aplicativos\MEGAUPLOADTOOLBAR

2008-02-14 00:18 --------- d-----w C:\Documents and Settings\Matheus\Dados de aplicativos\MegauploadToolbar

2008-02-10 17:40 --------- d-----w C:\Documents and Settings\Agnes\Dados de aplicativos\MEGAUPLOADTOOLBAR

2008-02-09 01:59 --------- d-----w C:\Documents and Settings\Marcela\Dados de aplicativos\LimeWire

2008-02-08 12:12 --------- d-----w C:\Documents and Settings\Marcelo\Dados de aplicativos\MEGAUPLOADTOOLBAR

2008-01-16 13:42 --------- d-----w C:\Arquivos de programas\MSN Messenger

2008-01-16 13:42 --------- d-----w C:\Arquivos de programas\Messenger Plus! Live

2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys

2007-12-16 13:10 --------- d-----w C:\Documents and Settings\Agnes\Dados de aplicativos\LimeWire

2007-12-16 01:01 --------- d-----w C:\Arquivos de programas\LimeWire

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

REGEDIT4

*Nota* entradas vazias & leg¡timas por defeito nÆo sÆo mostradas.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Bold axis"="C:\DOCUME~1\Matheus\DADOSD~1\HEARTS~1\tool style.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 09:06 88363 C:\WINDOWS\AGRSMMSG.exe]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]

"TkBellExe"="C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" [2006-08-27 01:42 180269]

"QuickTime Task"="C:\windows\system32\qttask.exe" [2006-09-27 20:51 77824]

"SunJavaUpdateSched"="C:\Arquivos de programas\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 14:03 36975]

"avast!"="C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 11:00 79224]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="C:\Arquivos de programas\MSN Messenger\msnmsgr.exe" [ ]

C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\

Adobe Reader Speed Launch.lnk - C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 05:44:06 29696]

Microsoft Office.lnk - C:\Arquivos de programas\Microsoft Office\Office\OSA9.EXE [1999-02-17 17:05:56 65588]

R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);C:\WINDOWS\system32\DRIVERS\RMSPPPOE.SYS [2002-06-10 00:09]

.

**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-02-14 20:52:16

Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializ veis ocultas ...

Procurando ficheiros ocultos ...

Varredura completada com sucesso

Ficheiros ocultos: 0

**************************************************************************

.

------------------------ Other Running Processes ------------------------

.

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\wdfmgr.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

.

**************************************************************************

.

Tempo para conclusÆo: 2008-02-14 20:54:51 - machine was rebooted

ComboFix-quarantined-files.txt 2008-02-14 22:54:44

.

2008-02-14 11:28:51 --- E O F ---

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:58:52, on 14/2/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe

C:\windows\system32\qttask.exe

C:\Arquivos de programas\Java\jre1.5.0_06\bin\jusched.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\notepad.exe