[Resolvido]Trojan win32:Pc client-ny

[Papillon]

Estou cm o trojan win32:Pc client-ny, na seguinte pasta c:\windows\system32\avpo0.dll, gostaria de uma ajuda para eliminar ele.E queria tb saber se ele influencia no media player e nos outros q o pc pode reproduzir, segue abaixo meu hijackthis

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:44:08, on 8/3/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\System32\PAStiSvc.exe

C:\WINDOWS\system32\svchost.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Arquivos de programas\Windows Live\Messenger\usnsvc.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\Arquivos de programas\Pando Networks\Pando\pando.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\ARQUIV~1\FREEDO~1\fdm.exe

C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.globo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = &http://home.microsoft.com/intl/br/access/allinone.asp

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R3 - URLSearchHook: Yahoo! Barra de Ferramentas - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn0\yt.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn0\yt.dll

O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: CInterceptor Object - {38D3FE60-3D53-4F37-BB0E-C7A97A26A156} - C:\Arquivos de programas\Pando Networks\Pando\PandoIEPlugin.dll

O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\ARQUIV~1\MEGAUP~1\MEGAUP~1.DLL

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Arquivos de programas\Free Download Manager\iefdmcks.dll

O3 - Toolbar: Yahoo! Barra de Ferramentas - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn0\yt.dll

O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\ARQUIV~1\MEGAUP~1\MEGAUP~1.DLL

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [AdobeUpdater] C:\Arquivos de programas\Arquivos comuns\Adobe\Updater5\AdobeUpdater.exe

O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe

O4 - HKCU\..\Run: [avpa] C:\WINDOWS\system32\avpo.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlall.htm

O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlselected.htm

O8 - Extra context menu item: Download with Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dllink.htm

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.MSN.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} - http://messenger.zone.MSN.com/binary/Solit...wn.cab56986.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://download.bitdefender.com/resources/scan8/oscan8.cab

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://messenger.zone.MSN.com/binary/ZIntro.cab56649.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.MSN.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - http://messenger.zone.MSN.com/binary/MineS...er.cab56986.cab

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

--

End of file - 7406 bytes

[miliane]

Olá Papillon,

Baixe o ComboFix.

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Feche todas as janelas e programas.

• Desative seu antivirus, antispywares e firewall, para não causar conflitos. Mantenha-os desativados até terminar as instruções.
• Dê um duplo clique no ComboFix.exe, clique em Executar, digite 1 em seguida Enter para prosseguir o Fix.
• Dura uma média de 10 minutos.
• O ComboFix reiniciará o PC automaticamente para completar o processo de remoção.
• Quando acabar, será gerado um log, C:\ComboFix.txt.
• IMPORTANTE: Não use o mouse nem o teclado quando o ComboFix estiver rodando. Para parar ou sair do ComboFix, tecle "N".
• Anexe o ComboFix.txt à sua resposta conforme as instruções abaixo

  http://linhadefensiva.uol.com.br/forum/ind...p?showtopic=595

Gere novo log do HijackThis e coloque em sua resposta.

OBS: Não rode o ComboFix mais do que uma vez. Isso irá sobreescrever o log e dificultará a remoção do(s) malware(s).

[Papillon]

[miliane]

Olá Papillon,

Vamos às instruções.

1º Passo

Acesse o site VirusTotal e mande para análise os seguintes arquivos:

C:\WINDOWS\pss\smsmwss.exe

C:\WINDOWS\pss\jmsdbrcfg.exe

C:\WINDOWS\winhlps.exe

C:\WINDOWS\winhpl32.exe

Poste os resultados em sua resposta.

2º Passo

Desative seu antivirus, antispywares e firewall, para não causar conflitos. Mantenha-os desativados até terminar as instruções.

Vá em Iniciar > Executar e digite (ou copie e cole): ComboFix /u

Dê o OK. Aguarde, pois isso irá desinstalar o ComboFix.

Apague as pastas C:\ComboFix e X:\Qoobox, caso existam. Apague também os logs anteriores que estão em C:\, caso ainda existam.

Baixe o ComboFix novamente.

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Selecione e copie o texto dentro do CODE. Abra o Bloco de notas e cole o que copiou. Salve então, na área de trabalho, com o nome de CFScript.txt.

OBS: Certifique-se de copiar começando pela letra "F" de File.

Arraste agora o CFScript.txt para o ComboFix conforme a demonstração abaixo.

File::
C:\b.com
C:\autorun.inf
C:\WINDOWS\system32\avpo.exe
C:\WINDOWS\system32\avpo.exe
C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\Wapp.exe
C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\smsmwss.exe
C:\WINDOWS\system32\winhpl32.exe

O ComboFix irá rodar e reiniciará o PC automaticamente para completar o processo de remoção.

* Caso isso não aconteça, então reinicie manualmente.

IMPORTANTE: Não use o mouse nem o teclado quando o ComboFix estiver rodando.

Quando acabar, será gerado um log, que estará em C:\ComboFix.txt.

OBS: Não rode o ComboFix mais do que uma vez. Isso irá sobreescrever o log e dificultará a remoção do(s) malware(s)

Faça um novo log do HijackThis e cole na sua resposta, juntamente com o novo log do ComboFix.

Anexe o ComboFix.txt à sua resposta.

[Papillon]

Miliane segue o 1° passo, os resultados estão separados por uma linha grande

Resultado do arquivo C:\WINDOWS\pss\smsmwss.exe

Arquivo smsmwss.exeCommon_Startup recebido em 2007.11.17 18:48:29 (CET)

Andamento: terminado

Resultado: 7/32 (21.88%)

Modo compacto

Imprimir resultados

Antivírus Versão Última Atualização Resultado

AhnLab-V3 - - -

AntiVir - - -

Authentium - - -

Avast - - -

AVG - - SHeur.TVD

BitDefender - - -

CAT-QuickHeal - - -

ClamAV - - PUA.Packed.Themida

DrWeb - - -

eSafe - - -

eTrust-Vet - - -

Ewido - - -

FileAdvisor - - -

Fortinet - - -

F-Prot - - W32/Heuristic-162!Eldorado

F-Secure - - -

Ikarus - - MemScanBackdoor.VB.EV

Kaspersky - - -

McAfee - - -

Microsoft - - -

NOD32v2 - - -

Norman - - -

Panda - - -

Prevx1 - - Heuristic: Suspicious Self Modifying EXE

Rising - - -

Sophos - - -

Sunbelt - - VIPRE.Suspicious

Symantec - - -

TheHacker - - -

VBA32 - - -

VirusBuster - - -

Webwasher-Gateway - - Win32.EPO.gen (suspicious)

Informações adicionais

MD5: 3ffdedf37d1a79cebe28d539f06e725b

SHA1: d5baeb3558f3111334735eeb8d4585a65c599473

SHA256: e6297377a0a6389ec43cf6a3e1492bf66a8181220b5d69c47845120960af19d9

SHA512: 17eca6c240836c716a4841c5489c808aff80e504eb6711a48e379e624ff924c7 2a6f337bd5112182f1645a09e4da6e8ad5d1fade6f2bd9cb1d98d549db0e3aa5

_______________________________________________________________________________________________________

Resultado do arquivo C:\WINDOWS\pss\jmsdbrcfg.exe

Arquivo jmsdbrcfg.exeCommon_Startup recebido em 2007.11.05 12:05:23 (CET)

Andamento: terminado

Resultado: 2/32 (6.25%)

Modo compacto

Imprimir resultados

Antivírus Versão Última Atualização Resultado

AhnLab-V3 - - -

AntiVir - - -

Authentium - - -

Avast - - -

AVG - - -

BitDefender - - -

CAT-QuickHeal - - -

ClamAV - - -

DrWeb - - -

eSafe - - -

eTrust-Vet - - -

Ewido - - -

FileAdvisor - - -

Fortinet - - -

F-Prot - - -

F-Secure - - -

Ikarus - - -

Kaspersky - - -

McAfee - - -

Microsoft - - -

NOD32v2 - - -

Norman - - -

Panda - - -

Prevx1 - - Heuristic: Suspicious File With Covert Attributes

Rising - - -

Sophos - - -

Sunbelt - - -

Symantec - - -

TheHacker - - -

VBA32 - - -

VirusBuster - - -

Webwasher-Gateway - - Virus.Win32.FileInfector.gen (suspicious)

Informações adicionais

MD5: 37e33dda436bc0a9e01cce0a7700f387

SHA1: be9e6897975f6e9b8ecc42784f8355331f96893d

SHA256: 1ac5f0e7c18967f3f8757dd409ed0f22e827e601e0df9dbcbdc5b6bb895ee1b3

SHA512: 34a620ea95ad01df8de57e975ef050acd386e327cad92ecfa2a8d02aa9ba6b06 f6d363e888e00dfcacee98aa006796d8bb50f05dbccd021c63b555df48fddc04

_______________________________________________________________________________________________________

Resultado do arquivo C:\WINDOWS\winhlps.exe

Arquivo 1012.mp3 recebido em 2008.03.03 16:47:17 (CET)

Andamento: terminado

Resultado: 13/32 (40.62%)

Modo compacto

Imprimir resultados

Antivírus Versão Última Atualização Resultado

AhnLab-V3 2008.2.29.1 2008.03.03 -

AntiVir 7.6.0.73 2008.03.03 Worm/Agent.A.122

Authentium 4.93.8 2008.03.02 -

Avast 4.7.1098.0 2008.03.02 Win32:Dadobra-DX

AVG 7.5.0.516 2008.03.03 Generic9.AJRH

BitDefender 7.2 2008.03.03 Trojan.Agent.Delf.GY

CAT-QuickHeal 9.50 2008.03.01 -

ClamAV 0.92.1 2008.03.03 -

DrWeb 4.44.0.09170 2008.03.03 MULDROP.Trojan

eSafe 7.0.15.0 2008.02.28 -

eTrust-Vet 31.3.5582 2008.03.03 -

Ewido 4.0 2008.03.03 -

FileAdvisor 1 2008.03.03 -

Fortinet 3.14.0.0 2008.03.03 -

F-Prot 4.4.2.54 2008.03.02 -

F-Secure 6.70.13260.0 2008.03.03 -

Ikarus T3.1.1.20 2008.03.03 BehavesLikeWin32.SMTP-Mailer

Kaspersky 7.0.0.125 2008.03.03 Heur.Trojan.Generic

McAfee 5242 2008.02.29 -

Microsoft 1.3301 2008.03.03 -

NOD32v2 2917 2008.03.03 probably unknown NewHeur_PE virus

Norman 5.80.02 2008.02.29 -

Panda 9.0.0.4 2008.03.02 Trj/Banker.JUZ

Prevx1 V2 2008.03.03 -

Rising 20.34.02.00 2008.03.03 -

Sophos 4.27.0 2008.03.03 -

Sunbelt 3.0.906.0 2008.02.28 Trojan.Agent.AGIY

Symantec 10 2008.03.03 Trojan Horse

TheHacker 6.2.92.231 2008.03.02 -

VBA32 3.12.6.2 2008.02.27 suspected of Win32 Shadow AutoStart Install

VirusBuster 4.3.26:9 2008.03.03 -

Webwasher-Gateway 6.6.2 2008.03.03 Worm.Agent.A.122

Informações adicionais

Tamano archivo: 1241600 bytes

MD5: d831fe12d6484f9c83e6b326a76273c4

SHA1: bd4a5840e043b52b1653cb990f3d4d9089c80373

PEiD: PECompact 2.xx --> BitSum Technologies

packers: PECompact, PECompact

packers: PecBundle, PECompact

packers: PE_Patch.PECompact, PecBundle, PECompact, PE_Patch.PECompact, PecBundle, PECompact, PE_Patch.PECompact, PecBundle, PECompact

_______________________________________________________________________________________________________

Resultado do arquivo C:\WINDOWS\winhpl32.exe

Arquivo winhpl32.exe recebido em 2008.03.04 17:59:21 (CET)

Andamento: terminado

Resultado: 11/32 (34.38%)

Modo compacto

Imprimir resultados

Antivírus Versão Última Atualização Resultado

AhnLab-V3 - - -

AntiVir - - HEUR/Crypted

Authentium - - Possibly a new variant of W32/Threat-SysVenFak-based!Maximus

Avast - - -

AVG - - Generic9.AKBT

BitDefender - - Trojan.Agent.Delf.GY

CAT-QuickHeal - - Trojan.Agent.rao

ClamAV - - -

DrWeb - - -

eSafe - - -

eTrust-Vet - - -

Ewido - - -

FileAdvisor - - -

Fortinet - - -

F-Prot - - W32/Heuristic-119!Eldorado

F-Secure - - -

Ikarus - - -

Kaspersky - - Heur.Trojan.Generic

McAfee - - -

Microsoft - - -

NOD32v2 - - probably unknown NewHeur_PE virus

Norman - - -

Panda - - Trj/Banker.JUZ

Prevx1 - - -

Rising - - -

Sophos - - -

Sunbelt - - -

Symantec - - -

TheHacker - - -

VBA32 - - suspected of Win32 Shadow AutoStart Install

VirusBuster - - -

Webwasher-Gateway - - Heuristic.Crypted

Informações adicionais

MD5: 2f2a06f28b6f991364e38242e9ee5482

SHA1: 90a3ab2c8a8b60085f978fdaa9d90244c8089c1b

SHA256: 80e4ba143d299a4d1432bdc37005b6693033b82711e0ab991b32fa733a416794

SHA512: 2f251dd8fba4377d767a10fd898c1b26353c0dc08bfc41067dde96bb73749414 c4a697d9c0b25ba6245854152e9d9b4b81f833e951bab304741ea16520302fc2

[Papillon]

Esse é o hijackthis

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 01:33:54, on 10/3/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\System32\PAStiSvc.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\System32\svchost.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\Arquivos de programas\internet explorer\iexplore.exe

C:\Arquivos de programas\Pando Networks\Pando\pando.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.globo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R3 - URLSearchHook: Yahoo! Barra de Ferramentas - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn0\yt.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn0\yt.dll

O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: CInterceptor Object - {38D3FE60-3D53-4F37-BB0E-C7A97A26A156} - C:\Arquivos de programas\Pando Networks\Pando\PandoIEPlugin.dll

O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\ARQUIV~1\MEGAUP~1\MEGAUP~1.DLL

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Arquivos de programas\Free Download Manager\iefdmcks.dll

O3 - Toolbar: Yahoo! Barra de Ferramentas - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn0\yt.dll

O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\ARQUIV~1\MEGAUP~1\MEGAUP~1.DLL

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlall.htm

O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlselected.htm

O8 - Extra context menu item: Download with Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dllink.htm

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.MSN.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab

O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} - http://messenger.zone.MSN.com/binary/Solit...wn.cab56986.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://download.bitdefender.com/resources/scan8/oscan8.cab

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://messenger.zone.MSN.com/binary/ZIntro.cab56649.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.MSN.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - http://messenger.zone.MSN.com/binary/MineS...er.cab56986.cab

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

--

End of file - 7569 bytes

E esse é o combofix

ComboFix 08-03-09.4 - Joao Paulo 2008-03-10 1:16:46.5 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.29 [GMT -3:00]

Executando de: C:\Documents and Settings\Joao Paulo\Desktop\ComboFix.exe

Command switches used :: C:\Documents and Settings\Joao Paulo\Desktop\CFScript.txt

* Criado um novo ponto de restauro

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::

C:\autorun.inf

C:\b.com

C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\smsmwss.exe

C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\Wapp.exe

C:\WINDOWS\system32\avpo.exe

C:\WINDOWS\system32\winhpl32.exe

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\autorun.inf

C:\b.com

C:\WINDOWS\system32\avpo.exe

C:\WINDOWS\system32\winhpl32.exe

.

((((((((((((((((((((((( Ficheiros criados de 2008-02-10 to 2008-03-10 ))))))))))))))))))))))))))))))))

.

2008-03-09 03:19 . 2008-03-10 00:05 <DIR> d-------- C:\Arquivos de programas\JLC's Software

2008-03-09 02:00 . 2004-05-14 16:53 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll

2008-03-09 02:00 . 2004-05-14 16:53 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll

2008-03-09 02:00 . 2004-05-14 16:53 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll

2008-03-09 02:00 . 2004-05-14 16:53 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll

2008-03-09 02:00 . 2004-01-12 02:09 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll

2008-03-09 02:00 . 2004-05-14 16:53 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll

2008-03-09 02:00 . 2003-11-04 15:10 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll

2008-03-09 02:00 . 2004-05-14 16:53 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll

2008-03-08 20:43 . 2008-03-08 20:43 <DIR> d-------- C:\Arquivos de programas\Trend Micro

2008-03-08 20:30 . 2008-03-08 20:17 691,545 --a------ C:\WINDOWS\unins000.exe

2008-03-08 20:30 . 2008-03-08 20:30 2,547 --a------ C:\WINDOWS\unins000.dat

2008-03-08 01:42 . 2008-03-08 01:43 <DIR> d-------- C:\Arquivos de programas\LimeWire

2008-03-03 01:35 . 2008-03-03 01:35 <DIR> d-------- C:\Arquivos de programas\Microsoft SQL Server Compact Edition

2008-03-02 22:12 . 2008-03-03 00:56 <DIR> d--hsc--- C:\Arquivos de programas\Arquivos comuns\WindowsLiveInstaller

2008-03-02 22:10 . 2008-03-03 00:37 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\WLInstaller

2008-03-02 00:09 . 2008-03-02 19:31 <DIR> d-------- C:\DIVEXT

2008-02-29 23:27 . 2008-03-02 19:32 <DIR> d-------- C:\WINDOWS\TEMP_DIV

2008-02-29 22:31 . 2008-02-29 22:31 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Borland Shared

2008-02-29 22:31 . 2001-05-11 05:00 183,808 --a------ C:\WINDOWS\system32\BDEADMIN.CPL

2008-02-29 22:30 . 1998-10-09 17:56 327,168 --a------ C:\WINDOWS\IsUn0416.exe

2008-02-25 19:44 . 2008-02-25 19:44 <DIR> d-------- C:\Arquivos de programas\PC Camera

2008-02-25 19:44 . 2008-02-25 19:44 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\PCCamera

2008-02-12 13:55 . 2008-03-10 01:16 <DIR> d-------- C:\Documents and Settings\Joao Paulo\Dados de aplicativos\Free Download Manager

2008-02-12 13:55 . 2008-02-12 13:55 <DIR> d-------- C:\Arquivos de programas\Free Download Manager

2008-02-11 13:12 . 2008-02-11 13:12 <DIR> d-------- C:\Arquivos de programas\Velox

2008-02-10 22:12 . 2008-02-10 22:12 <DIR> d-------- C:\Documents and Settings\Joao Paulo\Dados de aplicativos\XCPCSync.OEM

2008-02-10 22:05 . 1998-06-18 00:00 89,360 --a------ C:\WINDOWS\system32\VB5DB.DLL

2008-02-10 22:05 . 2006-02-23 15:59 78,096 --a------ C:\WINDOWS\system32\GAPI32.dll

2008-02-10 22:05 . 2008-02-10 22:05 1,447 --a------ C:\WINDOWS\system32\mapisvc.inf

2008-02-10 22:04 . 2006-01-23 13:15 27,008 --a------ C:\WINDOWS\system32\drivers\siusbmod.sys

2008-02-10 22:02 . 2008-02-10 22:05 <DIR> d-------- C:\Arquivos de programas\Mobile Phone Manager

2008-02-10 22:02 . 2008-02-10 22:02 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\XCPCSync.OEM

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-03-09 05:50 --------- d-----w C:\Documents and Settings\Joao Paulo\Dados de aplicativos\LimeWire

2008-03-09 01:18 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy

2008-03-09 00:02 --------- d-----w C:\Arquivos de programas\Spybot - Search & Destroy

2008-03-03 04:06 --------- d-----w C:\Arquivos de programas\Windows Live

2008-03-03 03:19 --------- d-----w C:\Arquivos de programas\MSN Messenger

2008-02-25 22:45 --------- d--h--w C:\Arquivos de programas\InstallShield Installation Information

2008-01-19 21:20 --------- d-----w C:\Arquivos de programas\DVD Decrypter

2008-01-17 23:03 --------- d-----w C:\Documents and Settings\Joao Paulo\Dados de aplicativos\Ahead

2008-01-13 19:57 --------- d-----w C:\Arquivos de programas\MediaCoder

2008-01-13 19:56 --------- d-----w C:\Arquivos de programas\Easy AVI-MPEG-RM-WMV Joiner

2008-01-13 19:56 --------- d-----w C:\Arquivos de programas\Any Video Converter

2007-12-19 03:38 700,928 -cs---w C:\WINDOWS\msnmgr.exe

2007-12-19 03:38 155,648 ----a-w C:\WINDOWS\system32\ssleay32.dll

2007-12-19 03:38 153,600 -cs---w C:\WINDOWS\winhpl32.exe

2007-12-19 03:38 1,241,600 -c--a-w C:\WINDOWS\winhlps.exe

2007-09-28 03:46 47,360 ----a-w C:\Documents and Settings\Joao Paulo\Dados de aplicativos\pcouffin.sys

2004-10-01 18:00 40,960 -c--a-w C:\Arquivos de programas\Uninstall_CDS.exe

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

.

REGEDIT4

*Nota* entradas vazias & legítimas por defeito não são mostradas.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"PowerBar"="" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avast!"="C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 10:00 79224]

"MSConfig"="C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.exe" [2004-08-04 00:45 159744]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:45 15360]

"DWQueuedReporting"="C:\ARQUIV~1\ARQUIV~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 19:29 39264]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoResolveSearch"= 1 (0x1)

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Adobe Reader Speed Launch.lnk]

backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^jmsdbrcfg.exe]

backup=C:\WINDOWS\pss\jmsdbrcfg.exeCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Microsoft Office.lnk]

backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^smsmwss.exe]

backup=C:\WINDOWS\pss\smsmwss.exeCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Wapp.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^Joao Paulo^Menu Iniciar^Programas^Inicializar^Mobile Phone Manager.lnk]

backup=C:\WINDOWS\pss\Mobile Phone Manager.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Joao Paulo^Menu Iniciar^Programas^Inicializar^Secunia PSI (BETA).lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

--a------ 2008-01-11 22:16 39792 C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]

-ra------ 2007-03-01 10:37 2321600 C:\Arquivos de programas\Arquivos comuns\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avpa]

C:\WINDOWS\system32\avpo.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Download Manager]

--a------ 2006-08-20 23:24 2068527 C:\Arquivos de programas\Free Download Manager\fdm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

--------- 2004-10-13 13:24 1694208 C:\Arquivos de programas\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmartSync - ScheduleSync]

--a------ 2006-02-23 15:48 45056 C:\ARQUIV~1\MOBILE~1\SMARTS~1\SCHEDU~1.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\THGuard]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]

--a------ 2006-11-03 19:20 866584 C:\Arquivos de programas\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winhpl32]

C:\WINDOWS\system32\winhpl32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winpos]

--a------ 2004-08-28 02:41 110592 C:\WINDOWS\winpos.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"C:\\Arquivos de programas\\Pando Networks\\Pando\\pando.exe"=

"C:\\Arquivos de programas\\LimeWire\\LimeWire.exe"=

"C:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"=

R3 PAC207;D-Link DSB-C120 PC Camera;C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-05-27 14:57]

S3 siusbmod;siusbmod;C:\WINDOWS\system32\DRIVERS\siusbmod.sys [2006-01-23 13:15]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2ed8c320-0796-11dc-8716-000fead3af08}]

\Shell\AutoRun\command - E:\b.com

\Shell\explore\Command - E:\b.com

\Shell\open\Command - E:\b.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{556f58b9-53f6-11dc-8849-000fead3af08}]

\Shell\AutoRun\command - E:\ntde1ect.com

\Shell\explore\Command - E:\ntde1ect.com

\Shell\open\Command - E:\ntde1ect.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e20dc052-8bd1-11dc-899f-000fead3af08}]

\Shell\Auto\command - fun.xls.exe

\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fun.xls.exe

.

Conteúdo da pasta 'Tarefas Agendadas'

"2008-03-10 04:06:19 C:\WINDOWS\Tasks\MP Scheduled Scan.job"

- C:\Arquivos de programas\Windows Defender\MpCmdRun.exe

.

**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-03-10 01:20:22

Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

PowerBar = ????<???D??sh?????6~????h???Z?6~(???*?6~t?@?l?@??kc???????????????????????????2???????????????????6~????W?9~0?6~????*?6~??6~????D??s?? ???????6~????l?@???????6~????t?@??6f?????????l?@?l?@?????Q?7~????t?@?????l?@?8?@?l?@?3??s????????????????????8?@?_??s8?@?8?@

Procurando ficheiros ocultos ...

Varredura completada com sucesso

Ficheiros ocultos: 0

**************************************************************************

.

Tempo para conclusão: 2008-03-10 1:21:44

ComboFix-quarantined-files.txt 2008-03-10 04:21:27

.

2008-01-13 22:10:03 --- E O F ---

[miliane]

Olá Papillon,

Vamos às instruções.

Desative seu antivirus, antispywares e firewall, para não causar conflitos. Mantenha-os desativados até terminar as instruções.

Vá em Iniciar > Executar e digite (ou copie e cole): ComboFix /u

Dê o OK. Aguarde, pois isso irá desinstalar o ComboFix.

Apague as pastas C:\ComboFix e X:\Qoobox, caso existam. Apague também os logs anteriores que estão em C:\, caso ainda existam.

Baixe o ComboFix novamente.

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Selecione e copie o texto dentro do CODE. Abra o Bloco de notas e cole o que copiou. Salve então, na área de trabalho, com o nome de CFScript.txt.

OBS: Certifique-se de copiar começando pela letra "F" de File.

Arraste agora o CFScript.txt para o ComboFix conforme a demonstração abaixo.

File::
C:\WINDOWS\msnmgr.exe
C:\WINDOWS\winhpl32.exe
C:\WINDOWS\winhlps.exe
C:\WINDOWS\system32\avpo.exe
C:\WINDOWS\system32\winhpl32.exe
E:\b.com
E:\ntde1ect.com
C:\WINDOWS\pss\jmsdbrcfg.exe
C:\WINDOWS\pss\smsmwss.exe
C:\WINDOWS\system32\avpo.exe
C:\WINDOWS\system32\winhpl32.exe
C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\jmsdbrcfg.exe
C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\smsmwss.exe
C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\Wapp.exe
Registry::
[-HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^jmsdbrcfg.exe]
[-HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^smsmwss.exe]
[-HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Wapp.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avpa]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winhpl32]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2ed8c320-0796-11dc-8716-000fead3af08}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{556f58b9-53f6-11dc-8849-000fead3af08}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e20dc052-8bd1-11dc-899f-000fead3af08}]

O ComboFix irá rodar e reiniciará o PC automaticamente para completar o processo de remoção.

* Caso isso não aconteça, então reinicie manualmente.

IMPORTANTE: Não use o mouse nem o teclado quando o ComboFix estiver rodando.

Quando acabar, será gerado um log, que estará em C:\ComboFix.txt.

Faça um novo log do HijackThis e cole na sua resposta, juntamente com o novo log do ComboFix.

Anexe o ComboFix.txt à sua resposta.

[Papillon]

[Papillon]

Miliane, o q devo fazer mais no pc?

[miliane]

Olá Papillon,

Desculpe a demora.

Seu log está limpo.: ;)

Digite no Executar combofix /u e clique em Ok. Na próxima janela clique em "Executar" e aguarde a remoção do programa;

Para manutenção de sistema, remoção de arquivos temporários e inválidos, e limpeza do registro, sugiro que você faça o download do Ccleaner:

http://www.ccleaner.com/download/

Clique em Erros > procurar erros > corrigir erros selecionados.

Depois, clique em Limpador > analisar > executar Ccleaner.

Desabilite (e torne a habilitar) a restauração do sistema.

Recomendo a leitura do tópico:

http://scriptbrasil.com.br/forum/index.php?showtopic=72355

Mais algum problema?

[Papillon]

Meu pc não ta aceitando entrada de pen drive e camera digital, nas entradas usb.mais aceita a wb cam, pode ser o q?não tem problema quanto a demora.

[miliane]

Olá Papillon,

Desculpe mais uma vez pela demora.

Já testou tanto a câmera quanto pen drive em outro pc?

[Papillon]

Miliane, não tem problema quanto a demora. em relação ao pen drive eu o formatei e já é possivel abrir ele sem problema e passei o anti virus nele.eu to sem problema no pc

[miliane]

Caso Resolvido.

Caso o autor queira a reabertura do tópico, envie uma MP com o link para um moderador da seção.

[miliane]

Caso Resolvido.

Caso o autor queira a reabertura do tópico, envie uma MP com o link para um moderador da seção.