Virtumonde.dll, vundo aqui é o meu hijack log ...

mason61391 · #1 21. Set 2008, 20:09

como o título diz i hhave um vírus, o que considero virtumonde.dll, iniciativa que foi dito é uma forma de vundo. Tenho sido haveing um computador lento e há muitos anti virus e pop-ups para ristry limpo ... e as coisa estranha, não posso atualizar nada no meu computador ?????? por favor se alguém poderia me dizer o que precisa fazer .... graças veja meu hijack log

Logfile da Trend Micro HijackThis v2.0.2
Scan guardado em 4:55:10, em 9/22/2008
Plataforma: Windows XP SP3 (WinNT 5/01/2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Executando processos:
C: \ WINDOWS \ System32 \ smss.exe
C: \ WINDOWS \ system32 \ winlogon.exe
C: \ WINDOWS \ system32 \ Services.exe
C: \ WINDOWS \ system32 \ lsass.exe
C: \ WINDOWS \ system32 \ Ati2evxx.exe
C: \ WINDOWS \ system32 \ svchost.exe
C: \ WINDOWS \ System32 \ svchost.exe
C: \ WINDOWS \ system32 \ Ati2evxx.exe
C: \ WINDOWS \ System32 \ WLTRYSVC.EXE
C: \ WINDOWS \ System32 \ bcmwltry.exe
C: \ WINDOWS \ system32 \ spoolsv.exe
C: \ PROGRA ~ 1 \ McAfee \ MSC \ mcmscsvc.exe
c: \ Program Files \ Common Files \ McAfee \ MNA \ mcnasvc.exe
c: \ PROGRA ~ 1 \ common ~ 1 \ mcafee \ mcproxy \ mcproxy.exe
C: \ Program Files \ McAfee \ VirusScan \ Mcshield.exe
C: \ Program Files \ McAfee \ MPF \ MPFSrv.exe
C: \ Program Files \ SiteAdvisor \ 6261 \ SAService.exe
C: \ WINDOWS \ system32 \ svchost.exe
C: \ WINDOWS \ Explorer.EXE
c: \ PROGRA ~ 1 \ mcafee.com \ agent \ mcagent.exe
C: \ WINDOWS \ stsystra.exe
C: \ Program Files \ Synaptics \ SynTP \ SynTPEnh.exe
C: \ WINDOWS \ system32 \ WLTRAY.exe
C: \ Program Files \ Java \ jre1.6.0_06 \ bin \ jusched.exe
C: \ Program Files \ ATI Technologies \ ATI.ACE \ Core-Static \ MOM.EXE
C: \ Program Files \ SiteAdvisor \ 6261 \ SiteAdv.exe
C: \ WINDOWS \ system32 \ ctfmon.exe
C: \ Program Files \ ATI Technologies \ ATI.ACE \ Core-Static \ ccc.exe
C: \ PROGRA ~ 1 \ McAfee \ VIRUSS ~ 1 \ mcsysmon.exe
C: \ WINDOWS \ system32 \ wscntfy.exe
C: \ WINDOWS \ system32 \ msiexec.exe
C: \ Program Files \ Windows Defender \ MsMpEng.exe
C: \ Program Files \ Windows Defender \ MSASCui.exe
C: \ WINDOWS \ system32 \ taskmgr.exe
C: \ Arquivos de Programas \ Internet Explorer \ iexplore.exe
C: \ Desktop \ Trend Micro \ HijackThis \ HijackThis.exe
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O3 - Toolbar: McAfee SiteAdvisor - (0BF43445-2F28-4351-9252-17FE6E806AA0) - C: \ Program Files \ SiteAdvisor \ 6261 \ SiteAdv.dll
O4 - HKLM \ .. \ Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM \ .. \ Run: [SynTPEnh] C: \ Program Files \ Synaptics \ SynTP \ SynTPEnh.exe
O4 - HKLM \ .. \ Run: [Broadcom Wireless Manager UI] C: \ WINDOWS \ system32 \ WLTRAY.exe
O4 - HKLM \ .. \ Run: [StartCCC] "C: \ Program Files \ ATI Technologies \ ATI.ACE \ Core-Static \ CLIStart.exe"
O4 - HKLM \ .. \ Run: [SunJavaUpdateSched] "C: \ Program Files \ Java \ jre1.6.0_06 \ bin \ jusched.exe"
O4 - HKLM \ .. \ Run: [RoxioDragToDisc] "C: \ Program Files \ Roxio \ Easy Media Creator 7 \ Drag a Disc \ DrgToDsc.exe"
O4 - HKLM \ .. \ Run: [QuickTime Task] "C: \ Program Files \ QuickTime \ QTTask.exe"-atboottime
O4 - HKLM \ .. \ Run: [SiteAdvisor] "C: \ Program Files \ SiteAdvisor \ 6261 \ SiteAdv.exe"
O4 - HKLM \ .. \ Run: [McENUI] C: \ PROGRA ~ 1 \ McAfee \ MHN \ McENUI.exe / ocultar
O4 - HKLM \ .. \ Run: [mcagent_exe] C: \ Program Files \ McAfee.com \ Agent \ mcagent.exe / runkey
O4 - HKLM \ .. \ Run: [Windows Defender] "C: \ Program Files \ Windows Defender \ MSASCui.exe"-hide
O4 - HKLM \ .. \ RunOnce: [SpybotDeletingA5528] comando / c del "C: \ WINDOWS \ SchedLgU.Txt"
O4 - HKLM \ .. \ RunOnce: [SpybotDeletingC6845] cmd / c del "C: \ WINDOWS \ SchedLgU.Txt"
O4 - HKCU \ .. \ Run: [CTFMON.EXE] C: \ WINDOWS \ system32 \ ctfmon.exe
O4 - HKCU \ .. \ Run: [LogitechSetup] D: \ Setup \ Setup.exe / start / restart / l: ptg
O4 - HKCU \ .. \ Run: [DelayShred] c: \ PROGRA ~ 1 \ mcafee \ mshr \ ShrCL.EXE / P10 / q C: \ DOCUME ~ 1 \ Administração ~ 1 \ LOCALS ~ 1 \ tempor ~ 1 \ Conteúdo . IE5 \ 13H31947 \ KB4564 ~ 1.SH! C: \ DOCUME ~ 1 \ Administração ~ 1 \ LOCALS ~ 1 \ tempor ~ 1 \ Content.IE5 \ 3P4O3QQE \ KB6712 ~ 1.SH! C: \ DOCUME ~ 1 \ Administração ~ 1 \ LOCALS ~ 1 \ tempor ~ 1 \ Content.IE5 \ H9JXXVQS \ KB7678 ~ 1.SH! C: \ DOCUME ~ 1 \ Administração ~ 1 \ Cookies \ AD9100 ~ 1.SH! C: \ DOCUME ~ 1 \ Administração ~ 1 \ Cookies \ AD9500 ~ 1.SH! C: \ DOCUME ~ 1 \ Administração ~ 1 \ Cookies \ AD8A94 ~ 1.SH! C: \ DOCUME ~ 1 \ Administração ~ 1 \ Cookies \ AD4B54 ~ 1.SH!
O4 - HKCU \ .. \ RunOnce: [SpybotDeletingB6548] comando / c del "C: \ WINDOWS \ SchedLgU.Txt"
O4 - HKCU \ .. \ RunOnce: [SpybotDeletingD1472] cmd / c del "C: \ WINDOWS \ SchedLgU.Txt"
O4 - HKUS \ S-1-5-19 \ .. \ Run: [CTFMON.EXE] C: \ WINDOWS \ system32 \ CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS \ S-1-5-20 \ .. \ Run: [CTFMON.EXE] C: \ WINDOWS \ system32 \ CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS \ S-1-5-18 \ .. \ Run: [CTFMON.EXE] C: \ WINDOWS \ system32 \ CTFMON.EXE (User 'SYSTEM')
O4 - HKUS \ S-1-5-18 \ .. \ RunOnce: [WUAppSetup] C: \ Program Files \ Common Files \ logishrd \ WUApp32.exe-v 0x08d9-p 0x046d vídeo-f-m-d logitech 10.5. 1,2023 (User 'SYSTEM')
O4 - HKUS \. DEFAULT \ .. \ Run: [CTFMON.EXE] C: \ WINDOWS \ system32 \ CTFMON.EXE (User 'Default user')
O4 - HKUS \. DEFAULT \ .. \ RunOnce: [WUAppSetup] C: \ Program Files \ Common Files \ logishrd \ WUApp32.exe-v 0x08d9-p 0x046d vídeo-f-m-d logitech 10.5.1.2023 (User 'Default usuário ')
O8 - Extra context menu item: E & xportar para o Microsoft Excel - res: / / C: \ PROGRA ~ 1 \ MICROS ~ 3 \ OFFICE11 \ EXCEL.EXE/3000
O9 - Extra button: (no name) - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_06 \ bin \ ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_06 \ bin \ ssv.dll
O9 - Extra button: Skype - (77BF5300-1474-4EC7-9980-D32B190E9B07) - C: \ WINDOWS \ system32 \ shdocvw.dll
O9 - Extra button: Research - (92780B25-18CC-41C8-B9BE-3C9C571A8263) - C: \ PROGRA ~ 1 \ MICROS ~ 3 \ OFFICE11 \ REFIEBAR.DLL
O9 - Extra button: (no name) - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ PROGRA ~ 1 \ SpyBot ~ 1 \ SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ PROGRA ~ 1 \ SpyBot ~ 1 \ SDHelper.dll
O9 - Extra button: (no name) - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C: \ WINDOWS \ Network Diagnostic \ xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @ Xpsp3res.dll, -20001 - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C: \ WINDOWS \ Network Diagnostic \ xpnetdiag.exe
O9 - Extra button: Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe
O18 - Protocol: linkscanner - (F274614C-63F8-47D5-A4D1-FBDDE494F8D1) - (no arquivo)
O18 - Protocol: skype4com - (FFC8B962-9B40-4DFF-9458-1830C7DD7F5D) - C: \ PROGRA ~ 1 \ common ~ 1 \ Skype \ SKYPE4 ~ 1.DLL
O20 - AppInit_DLLs: avgrsstx.dll zlpxgp.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C: \ WINDOWS \ system32 \ Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C: \ WINDOWS \ system32 \ ati2sgag.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C: \ Program Files \ Common Files \ LogiShrd \ SrvLnch \ SrvLnch.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C: \ PROGRA ~ 1 \ McAfee \ MSC \ mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c: \ Program Files \ Common Files \ McAfee \ MNA \ mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C: \ PROGRA ~ 1 \ McAfee \ VIRUSS ~ 1 \ mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c: \ PROGRA ~ 1 \ common ~ 1 \ mcafee \ mcproxy \ mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C: \ Program Files \ McAfee \ VirusScan \ Mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C: \ PROGRA ~ 1 \ McAfee \ VIRUSS ~ 1 \ mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C: \ Program Files \ McAfee \ MPF \ MPFSrv.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C: \ Program Files \ SiteAdvisor \ 6261 \ SAService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C: \ WINDOWS \ System32 \ WLTRYSVC.EXE
--
Fim do processo - 7660 bytes

**evilfantasy** · #2 21. Set 2008, 21:28

Baixar Malwarebytes' Anti-Malware (MBAM)

Dê um clique duplo mbam-setup.exe e siga as instruções para instalar o programa.
Ao final, certifique-se de uma marca de verificação é colocada ao lado da seguinte forma:
- Actualizar Malwarebytes' Anti-Malware
- Lançamento Malwarebytes' Anti-Malware
Em seguida, clique em Concluir.
Se uma atualização for encontrada, ela vai baixar e instalar a versão mais recente.
Uma vez carregado o programa, selecione Execute verificação rápidaE, em seguida, clique em Scan.
Quando a pesquisa estiver concluída, clique em OKE, em seguida, Mostrar resultados para ver os resultados.
Tenha certeza de que tudo está marcada, e clique em Remover Selecionados.
Desinfecção Quando estiver concluída, será aberto um log no Bloco de Notas e você pode ser solicitado a reiniciar. (Veja Nota Extra)
O log é automaticamente salvo pelo MBAM e pode ser visualizada clicando no separador no MBAM Logs.
Copie e cole todo o relatório em sua próxima resposta.

Nota adicional: Se MBAM encontrar um arquivo que é difícil de remover, você será presenteado com 1 de 2 solicitações, clique em OK para deixar MBAM e quer avançar com o processo de desinfecção, se solicitado para reiniciar o computador, faça-o imediatamente.

----------

Agora execute uma nova varredura HijackThis e postar o log.

mason61391 · #3 22. Set 2008, 13:31

Encaminhassem Corri que malwarebytes .. coisa e ele pegou esse

Malwarebytes' Anti-Malware 1/28
Database version: 1194
5/1/2600 Windows Service Pack 3
9/22/2008 8:55:50
mbam-log-2008-09-22 (20-55-50). txt
Scan type: Quick Scan
Objetos digitalizados: 53105
Tempo decorrido: 6 minuto (s), 1 segundo (s)
Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 10
Valores do Registro infectados: 2
Dados de Registro Items Infected: 2
Pastas infectadas: 1
Arquivos infectados: 15
Memory Processes Infected:
(N º itens maliciosos detectados)
Memory Modules Infected:
C: \ WINDOWS \ system32 \ ssqpmmNf.dll (Trojan.Vundo.H) -> Excluir no reboot.
Registry Keys Infected:
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Explorer \ Browser Helper Objects \ (7b1b1537-fcd3-4186-b5b8-e454c2fddb24) (Trojan.Vundo.H) -> Excluir no reboot.
HKEY_CLASSES_ROOT \ CLSID \ (7b1b1537-fcd3-4186-b5b8-e454c2fddb24) (Trojan.Vundo.H) -> Excluir no reboot.
HKEY_CLASSES_ROOT \ WR (Malware.Trace) -> quarentena e eliminado com sucesso.
HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ rdfa (Trojan.Vundo) -> quarentena e eliminado com sucesso.
HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ contim (Trojan.Vundo) -> quarentena e eliminado com sucesso.
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ dslcnnct (Trojan.Vundo) -> quarentena e eliminado com sucesso.
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ IProxyProvid er (Trojan.Vundo) -> quarentena e eliminado com sucesso.
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ FCOVM (Trojan.Vundo) -> quarentena e eliminado com sucesso.
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ RemoveRP (Trojan.Vundo) -> quarentena e eliminado com sucesso.
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ aoprndtws (Trojan.Vundo) -> quarentena e eliminado com sucesso.
Valores do Registro infectados:
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Run \ 7c0a0557 (Trojan.Vundo) -> quarentena e eliminado com sucesso.
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Run \ bm7f3936cb (Trojan.Agent) -> Excluir no reboot.
Dados de Registro Items Infected:
HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Contro l \ LSA \ Notification Packages (Trojan.Vundo.H) -> Data: c: \ windows \ system32 \ ssqpmmnf -> quarentena e eliminado com sucesso.
HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Contro l \ LSA \ Authentication Packages (Trojan.Vundo) -> Data: c: \ windows \ system32 \ ssqpmmnf -> Excluir no reboot.
Folders Infected:
C: \ WINDOWS \ system32 \ kBin02 (Trojan.Agent) -> quarentena e eliminado com sucesso.
Arquivos Infectados:
C: \ WINDOWS \ system32 \ ssqpmmNf.dll (Trojan.Vundo.H) -> Excluir no reboot.
C: \ WINDOWS \ system32 \ fNmmpqss.ini (Trojan.Vundo.H) -> quarentena e eliminado com sucesso.
C: \ WINDOWS \ system32 \ fNmmpqss.ini2 (Trojan.Vundo.H) -> quarentena e eliminado com sucesso.
C: \ WINDOWS \ system32 \ qwtbatxb.dll (Trojan.Vundo) -> quarentena e eliminado com sucesso.
C: \ WINDOWS \ system32 \ ysirza.dll (Trojan.Vundo) -> quarentena e eliminado com sucesso.
C: \ WINDOWS \ system32 \ vfcortyh.dll (Trojan.Vundo) -> Excluir no reboot.
C: \ Documents and Settings \ Administrador \ Configurações locais \ Temporary Internet Files \ Content.IE5 \ 7LVEI8GK \ upd105320 [1] (Trojan.Vundo) -> Excluir no reboot.
C: \ Documents and Settings \ Administrador \ Configurações locais \ Temporary Internet Files \ Content.IE5 \ TPEY0D0R \ nd82m0 [1] (Trojan.Vundo) -> Excluir no reboot.
C: \ WINDOWS \ system32 \ mcrh.tmp (Malware.Trace) -> quarentena e eliminado com sucesso.
C: \ WINDOWS \ cookies.ini (Malware.Trace) -> quarentena e eliminado com sucesso.
C: \ WINDOWS \ system32 \ jyyubyyg.dll (Trojan.Agent) -> Excluir no reboot.
C: \ WINDOWS \ system32 \ pac.txt (Malware.Trace) -> quarentena e eliminado com sucesso.
C: \ WINDOWS \ pskt.ini (Trojan.Vundo) -> quarentena e eliminado com sucesso.
C: \ WINDOWS \ BM7f3936cb.xml (Trojan.Vundo) -> quarentena e eliminado com sucesso.
C: \ WINDOWS \ BM7f3936cb.txt (Trojan.Vundo) -> quarentena e eliminado com sucesso.
*
*
*
Corri lo várias vezes depois disso, e agora ele diz que não há nada infectados ....

Eu só corria hijack .. e este é o resultado

Logfile da Trend Micro HijackThis v2.0.2
Scan guardado em 10:26:25, em 9/22/2008
Plataforma: Windows XP SP3 (WinNT 5/01/2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Executando processos:
C: \ WINDOWS \ System32 \ smss.exe
C: \ WINDOWS \ system32 \ winlogon.exe
C: \ WINDOWS \ system32 \ Services.exe
C: \ WINDOWS \ system32 \ lsass.exe
C: \ WINDOWS \ system32 \ Ati2evxx.exe
C: \ WINDOWS \ system32 \ svchost.exe
C: \ Program Files \ Windows Defender \ MsMpEng.exe
C: \ WINDOWS \ System32 \ svchost.exe
C: \ WINDOWS \ system32 \ Ati2evxx.exe
C: \ WINDOWS \ System32 \ WLTRYSVC.EXE
C: \ WINDOWS \ System32 \ bcmwltry.exe
C: \ WINDOWS \ system32 \ spoolsv.exe
C: \ PROGRA ~ 1 \ McAfee \ MSC \ mcmscsvc.exe
c: \ Program Files \ Common Files \ McAfee \ MNA \ mcnasvc.exe
c: \ PROGRA ~ 1 \ common ~ 1 \ mcafee \ mcproxy \ mcproxy.exe
C: \ Program Files \ McAfee \ VirusScan \ Mcshield.exe
C: \ Program Files \ McAfee \ MPF \ MPFSrv.exe
C: \ Program Files \ SiteAdvisor \ 6261 \ SAService.exe
C: \ WINDOWS \ system32 \ svchost.exe
C: \ WINDOWS \ Explorer.EXE
c: \ PROGRA ~ 1 \ mcafee.com \ agent \ mcagent.exe
C: \ WINDOWS \ stsystra.exe
C: \ Program Files \ Synaptics \ SynTP \ SynTPEnh.exe
C: \ WINDOWS \ system32 \ WLTRAY.exe
C: \ Program Files \ Java \ jre1.6.0_06 \ bin \ jusched.exe
C: \ Program Files \ Roxio \ Easy Media Creator 7 \ Drag a Disc \ DrgToDsc.exe
C: \ Program Files \ SiteAdvisor \ 6261 \ SiteAdv.exe
C: \ Program Files \ ATI Technologies \ ATI.ACE \ Core-Static \ MOM.EXE
C: \ Program Files \ Windows Defender \ MSASCui.exe
C: \ WINDOWS \ system32 \ ctfmon.exe
C: \ Program Files \ ATI Technologies \ ATI.ACE \ Core-Static \ ccc.exe
C: \ WINDOWS \ system32 \ wuauclt.exe
C: \ Program Files \ Skype \ Phone \ Skype.exe
C: \ PROGRA ~ 1 \ McAfee \ VIRUSS ~ 1 \ mcsysmon.exe
C: \ Program Files \ Skype \ Plugin Manager \ skypePM.exe
C: \ Arquivos de Programas \ Internet Explorer \ iexplore.exe
C: \ WINDOWS \ system32 \ wuauclt.exe
C: \ Desktop \ Trend Micro \ HijackThis \ HijackThis.exe
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - (04F27F39-1C1B-4A4F-8B5A-A531E364B7A6) - (no arquivo)
O2 - BHO: (no name) - (089FD14D-132B-48FC-8861-0048AE113215) - C: \ Program Files \ SiteAdvisor \ 6261 \ SiteAdv.dll
O2 - BHO: (no name) - (12637832-85dB-4C63-B9D6-12B3E50A52C9) - (no arquivo)
O2 - BHO: (no name) - (2504b4df-fd95-47a5-b804-b047829925c0) - (no arquivo)
O2 - BHO: (no name) - (41E299D0-5CFF-4705-A8AD-67B02579661C) - (no arquivo)
O2 - BHO: Spybot-S & D IE Protection - (53707962-6F74-2D53-2644-206D7942484F) - C: \ PROGRA ~ 1 \ SpyBot ~ 1 \ SDHelper.dll
O2 - BHO: SSVHelper Class - (761497BB-D6F0-462C-B6EB-D4DAF1D92D43) - C: \ Program Files \ Java \ jre1.6.0_06 \ bin \ ssv.dll
O2 - BHO: Windows Live Sign-in Helper - (9030D464-4C02-4ABF-8ECC-5164760863C6) - C: \ Program Files \ Common Files \ Microsoft Shared \ Windows Live \ WindowsLiveLogin.dll
O2 - BHO: (no name) - (C089CFFD-5CAA-4DA6-BC8B-39965E47AAF9) - (no arquivo)
O2 - BHO: (no name) - (D7C82C77-9CF6-4513-826E-B9B7ACDC4DB9) - (no arquivo)
O3 - Toolbar: McAfee SiteAdvisor - (0BF43445-2F28-4351-9252-17FE6E806AA0) - C: \ Program Files \ SiteAdvisor \ 6261 \ SiteAdv.dll
O4 - HKLM \ .. \ Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM \ .. \ Run: [SynTPEnh] C: \ Program Files \ Synaptics \ SynTP \ SynTPEnh.exe
O4 - HKLM \ .. \ Run: [Broadcom Wireless Manager UI] C: \ WINDOWS \ system32 \ WLTRAY.exe
O4 - HKLM \ .. \ Run: [StartCCC] "C: \ Program Files \ ATI Technologies \ ATI.ACE \ Core-Static \ CLIStart.exe"
O4 - HKLM \ .. \ Run: [SunJavaUpdateSched] "C: \ Program Files \ Java \ jre1.6.0_06 \ bin \ jusched.exe"
O4 - HKLM \ .. \ Run: [RoxioDragToDisc] "C: \ Program Files \ Roxio \ Easy Media Creator 7 \ Drag a Disc \ DrgToDsc.exe"
O4 - HKLM \ .. \ Run: [QuickTime Task] "C: \ Program Files \ QuickTime \ QTTask.exe"-atboottime
O4 - HKLM \ .. \ Run: [SiteAdvisor] "C: \ Program Files \ SiteAdvisor \ 6261 \ SiteAdv.exe"
O4 - HKLM \ .. \ Run: [McENUI] C: \ PROGRA ~ 1 \ McAfee \ MHN \ McENUI.exe / ocultar
O4 - HKLM \ .. \ Run: [mcagent_exe] C: \ Program Files \ McAfee.com \ Agent \ mcagent.exe / runkey
O4 - HKLM \ .. \ Run: [Windows Defender] "C: \ Program Files \ Windows Defender \ MSASCui.exe"-hide
O4 - HKCU \ .. \ Run: [CTFMON.EXE] C: \ WINDOWS \ system32 \ ctfmon.exe
O4 - HKCU \ .. \ Run: [LogitechSetup] D: \ Setup \ Setup.exe / start / restart / l: ptg
O4 - HKCU \ .. \ Run: [DelayShred] c: \ PROGRA ~ 1 \ mcafee \ mshr \ ShrCL.EXE / P10 / q C: \ DOCUME ~ 1 \ Administração ~ 1 \ LOCALS ~ 1 \ tempor ~ 1 \ Conteúdo . IE5 \ 13H31947 \ KB4564 ~ 1.SH! C: \ DOCUME ~ 1 \ Administração ~ 1 \ LOCALS ~ 1 \ tempor ~ 1 \ Content.IE5 \ 3P4O3QQE \ KB6712 ~ 1.SH! C: \ DOCUME ~ 1 \ Administração ~ 1 \ LOCALS ~ 1 \ tempor ~ 1 \ Content.IE5 \ H9JXXVQS \ KB7678 ~ 1.SH! C: \ DOCUME ~ 1 \ Administração ~ 1 \ Cookies \ AD9100 ~ 1.SH! C: \ DOCUME ~ 1 \ Administração ~ 1 \ Cookies \ AD9500 ~ 1.SH! C: \ DOCUME ~ 1 \ Administração ~ 1 \ Cookies \ AD8A94 ~ 1.SH! C: \ DOCUME ~ 1 \ Administração ~ 1 \ Cookies \ AD4B54 ~ 1.SH!
O4 - HKUS \ S-1-5-19 \ .. \ Run: [CTFMON.EXE] C: \ WINDOWS \ system32 \ CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS \ S-1-5-20 \ .. \ Run: [CTFMON.EXE] C: \ WINDOWS \ system32 \ CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS \ S-1-5-18 \ .. \ Run: [CTFMON.EXE] C: \ WINDOWS \ system32 \ CTFMON.EXE (User 'SYSTEM')
O4 - HKUS \ S-1-5-18 \ .. \ RunOnce: [WUAppSetup] C: \ Program Files \ Common Files \ logishrd \ WUApp32.exe-v 0x08d9-p 0x046d vídeo-f-m-d logitech 10.5. 1,2023 (User 'SYSTEM')
O4 - HKUS \. DEFAULT \ .. \ Run: [CTFMON.EXE] C: \ WINDOWS \ system32 \ CTFMON.EXE (User 'Default user')
O4 - HKUS \. DEFAULT \ .. \ RunOnce: [WUAppSetup] C: \ Program Files \ Common Files \ logishrd \ WUApp32.exe-v 0x08d9-p 0x046d vídeo-f-m-d logitech 10.5.1.2023 (User 'Default usuário ')
O8 - Extra context menu item: E & xportar para o Microsoft Excel - res: / / C: \ PROGRA ~ 1 \ MICROS ~ 3 \ OFFICE11 \ EXCEL.EXE/3000
O9 - Extra button: (no name) - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_06 \ bin \ ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_06 \ bin \ ssv.dll
O9 - Extra button: Skype - (77BF5300-1474-4EC7-9980-D32B190E9B07) - C: \ WINDOWS \ system32 \ shdocvw.dll
O9 - Extra button: Research - (92780B25-18CC-41C8-B9BE-3C9C571A8263) - C: \ PROGRA ~ 1 \ MICROS ~ 3 \ OFFICE11 \ REFIEBAR.DLL
O9 - Extra button: (no name) - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ PROGRA ~ 1 \ SpyBot ~ 1 \ SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ PROGRA ~ 1 \ SpyBot ~ 1 \ SDHelper.dll
O9 - Extra button: (no name) - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C: \ WINDOWS \ Network Diagnostic \ xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @ Xpsp3res.dll, -20001 - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C: \ WINDOWS \ Network Diagnostic \ xpnetdiag.exe
O9 - Extra button: Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe
O18 - Protocol: linkscanner - (F274614C-63F8-47D5-A4D1-FBDDE494F8D1) - (no arquivo)
O18 - Protocol: skype4com - (FFC8B962-9B40-4DFF-9458-1830C7DD7F5D) - C: \ PROGRA ~ 1 \ common ~ 1 \ Skype \ SKYPE4 ~ 1.DLL
O20 - AppInit_DLLs: avgrsstx.dll zlpxgp.dll fgdygo.dll
O20 - Winlogon Notify: awtuutTk - awtuutTk.dll (arquivo ausente)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C: \ WINDOWS \ system32 \ Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C: \ WINDOWS \ system32 \ ati2sgag.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C: \ Program Files \ Common Files \ LogiShrd \ SrvLnch \ SrvLnch.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C: \ PROGRA ~ 1 \ McAfee \ MSC \ mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c: \ Program Files \ Common Files \ McAfee \ MNA \ mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C: \ PROGRA ~ 1 \ McAfee \ VIRUSS ~ 1 \ mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c: \ PROGRA ~ 1 \ common ~ 1 \ mcafee \ mcproxy \ mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C: \ Program Files \ McAfee \ VirusScan \ Mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C: \ PROGRA ~ 1 \ McAfee \ VIRUSS ~ 1 \ mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C: \ Program Files \ McAfee \ MPF \ MPFSrv.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C: \ Program Files \ SiteAdvisor \ 6261 \ SAService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C: \ WINDOWS \ System32 \ WLTRYSVC.EXE
--
Fim do processo - 8474 bytes
*
*
*
Eu realmente preciso saber o que passa aqui Preciso voltar este notebook, obrigado ... deixe-me saber se houver algo que eu possa fazer para ajudar ...

**evilfantasy** · #4 22. Set 2008, 16:47

Desativar o Windows Defender

Precisamos de desativar o Windows Defender proteção em tempo real, uma vez que podem interferir com as correções que temos de fazer.

Abrir Windows Defender
Clique em Ferramentas, Configurações Gerais
Role para baixo e desmarque Ligue a proteção em tempo real (recomendado)
Depois de desligar esta opção, clique sobre o Salvar botão e feche o Windows Defender.

Após todas as correções estão completos, é muito importante que você ativar proteção em tempo real novamente.

----------

Abrir HijackThis e escolha Faça um sistema de verificação só.

Coloque uma marca de verificação ao lado dos seguintes entradas: (se houver)

O2 - BHO: (no name) - (04F27F39-1C1B-4A4F-8B5A-A531E364B7A6) - (no arquivo)
O2 - BHO: (no name) - (12637832-85dB-4C63-B9D6-12B3E50A52C9) - (no arquivo)
O2 - BHO: (no name) - (2504b4df-fd95-47a5-b804-b047829925c0) - (no arquivo)
O2 - BHO: (no name) - (41E299D0-5CFF-4705-A8AD-67B02579661C) - (no arquivo)
O2 - BHO: (no name) - (C089CFFD-5CAA-4DA6-BC8B-39965E47AAF9) - (no arquivo)
O2 - BHO: (no name) - (D7C82C77-9CF6-4513-826E-B9B7ACDC4DB9) - (no arquivo)
O18 - Protocol: linkscanner - (F274614C-63F8-47D5-A4D1-FBDDE494F8D1) - (no arquivo)
O20 - AppInit_DLLs: avgrsstx.dll zlpxgp.dll fgdygo.dll
O20 - Winlogon Notify: awtuutTk - awtuutTk.dll (arquivo ausente)

Importante: Feche todas as janelas excepto no HijackThis e clique em Fix controlados.

Sair HijackThis e reinicie o computador para registrar as alterações feitas pelo HijackThis.

----------

Download ComboFix por subcategorias de um dos links abaixo. Certifique-se de guardá-lo para o topo Desktop.

Link # 1
Link # 2

** Nota: É importante que ele é guardado directamente para o seu desktop

Feche todos os browsers abertos. (Firefox, Internet Explorer, etc) antes de iniciar ComboFix.

Temporariamente desabilitar seu antivírus, E qualquer antispyware proteção em tempo real antes realizar uma varredura. Clique este link para ver uma lista de programas de segurança que devem ser desativados e como desativá-los. (McAfee não poderia transformar completamente desligado. ComboFix simplesmente executar qualquer jeito e deixar de correr se alguma coisa tenta bloqueá-lo.)

Dê um clique duplo combofix.exe e siga as instruções.
Quando terminar ComboFix irá produzir um log para você.
Publicar a Log ComboFix e um novo HijackThis log na sua próxima resposta.

Importante: Não mouseclick ComboFix da janela enquanto ele está sendo executado. Isso pode fazer com que a barraca.

Lembre-se de reativar a sua protecção antivírus e antispyware ComboFix quando estiver completa.

mason61391 · #5 22. Set 2008, 19:14

ok Corri combinacão correção, aqui é o reslults ...

ComboFix 08-09-20.05 - Administrador 2008-09-23 4:07:24.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.420.1033.18.526 [GMT 2:00]
Executando de: C: \ Documents and Settings \ Administrador \ Desktop \ ComboFix.exe
* Criado um novo ponto restaurar
ATENÇÃO-ESTE NÃO TEM MÁQUINA DE RECUPERAÇÃO CONSOLE INSTALLED!
.
((((((((((((((((((((((((((((((((((((((( Outros Supressões ))))))))) ))))))))))))))))))))))))))))))))))))))))
.
C: \ WINDOWS \ system32 \ djynmrpe.ini
C: \ WINDOWS \ system32 \ EMVwxyay.ini
C: \ WINDOWS \ system32 \ fxdehybr.ini
C: \ WINDOWS \ system32 \ hgillUtv.ini
C: \ WINDOWS \ system32 \ hwpdknag.ini
C: \ WINDOWS \ system32 \ hytrocfv.ini
C: \ WINDOWS \ system32 \ jrawajwy.ini
C: \ WINDOWS \ system32 \ kruvwslm.ini
C: \ WINDOWS \ system32 \ ljbuenel.ini
C: \ WINDOWS \ system32 \ mbpyegow.ini
C: \ WINDOWS \ system32 \ MSINET.oca
C: \ WINDOWS \ system32 \ oopfgjdw.ini
C: \ WINDOWS \ system32 \ oujogpou.ini
C: \ WINDOWS \ system32 \ ovbmvuhg.ini
C: \ WINDOWS \ system32 \ rmkrhevi.ini
C: \ WINDOWS \ system32 \ uhikvuhh.ini
C: \ WINDOWS \ system32 \ vpgysgqj.ini
.
((((((((((((((((((((((((( Arquivos criados a partir de 2008/08/23 a 2008/09/23 ))))))))))) ))))))))))))))))))))
.
2008/09/23 01:06. 2008/09/23 01:06 <dir> d -------- C: \ Program Files \ DivX
2008/09/22 22:11. 2008/09/22 22:20 1374 - a ------ C: \ WINDOWS \ imsins.BAK
2008/09/22 21:30. 2008/05/01 16:33 331,776 ----- c --- C: \ WINDOWS \ system32 \ dllcache \ Msadce.dll
2008/09/22 21:25. 2008/04/11 21:04 691,712 ----- c --- C: \ WINDOWS \ system32 \ dllcache \ Inetcomm.dll
2008/09/22 20:47. 2008/09/22 20:47 <dir> d -------- C: \ Documents and Settings \ All Users \ Application Data \ Malwarebytes
2008/09/22 20:47. 2008/09/22 20:47 <dir> d -------- C: \ Documents and Settings \ Administrador \ Application Data \ Malwarebytes
2008/09/22 20:47. 2008/09/10 00:04 38,528 - a ------ C: \ WINDOWS \ system32 \ drivers \ mbamswissarmy.sys
2008/09/22 20:47. 2008/09/10 00:03 17,200 - a ------ C: \ WINDOWS \ system32 \ drivers \ mbam.sys
2008/09/22 04:54. 2008/09/22 20:47 <dir> d -------- C: \ Desktop
2008/09/22 04:47. 2008/09/22 04:48 <dir> d -------- C: \ Program Files \ Windows Defender
2008/09/22 04:36. 2008/09/22 04:36 <dir> d - h ----- C: \ WINDOWS \ system32 \ GroupPolicy
2008/09/22 02:58. 2008-09-22 02:58 268 - ah ----- C: \ sqmdata00.sqm
2008/09/22 00:30. 2008/09/22 00:30 <dir> d -------- C: \ VundoFix Backups
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))) ))))))))))))))))))))))))))))))))))))))))))))
.
2008/09/22 23:08 --------- d ----- w C: \ Documents and Settings \ Administrador \ Application Data \ LimeWire
2008/09/22 20:34 --------- d ----- w C: \ Documents and Settings \ Administrador \ Application Data \ Skype
2008/09/22 20:25 --------- d ----- w C: \ Documents and Settings \ Administrador \ Application Data \ skypePM
2008/09/22 03:36 --------- d ----- w C: \ Documents and Settings \ All Users \ Application Data \ Spybot - Search & Destroy
2008/09/22 00:07 --------- d ----- w C: \ Program Files \ McAfee
2008/08/14 04:47 --------- d ----- w C: \ Documents and Settings \ Convidado \ Dados de aplicativos \ SiteAdvisor
2008/08/02 01:04 --------- d ----- w C: \ Program Files \ Enigma Software Group
2008/07/30 03:57 876,883 - sha-w C: \ WINDOWS \ system32 \ EMVwxyay.ini2
2008/07/30 03:49 --------- d ----- w C: \ Program Files \ CCleaner
2008/07/30 03:05 --------- d ----- w C: \ Documents and Settings \ Convidado \ Dados de aplicativos \ ATI
2008/07/29 03:35 --------- d ----- w C: \ Program Files \ Common Files \ LogiShrd
2008/07/27 03:46 --------- d ----- w C: \ Documents and Settings \ All Users \ Dados de aplicativos \ Roxio
2008/07/26 06:06 --------- d ----- w C: \ Documents and Settings \ All Users \ Application Data \ McAfee
2008/07/26 03:45 --------- d ----- w C: \ Arquivos de Programas \ Spybot - Search & Destroy
2008/07/25 08:36 524,288 ---- aw C: \ WINDOWS \ system32 \ DivXsm.exe
2008/07/24 18:28 --------- d ----- w C: \ Program Files \ SiteAdvisor
2008/07/24 16:32 --------- d ----- w C: \ Documents and Settings \ Administrador \ Dados de aplicativos \ SiteAdvisor
2008/07/23 16:50 9,464 ------ w C: \ WINDOWS \ system32 \ drivers \ cdralw2k.sys
2008/07/23 16:50 9,336 ------ w C: \ WINDOWS \ system32 \ drivers \ cdr4_xp.sys
2008/07/23 16:50 43,528 ------ w C: \ WINDOWS \ system32 \ drivers \ PxHelp20.sys
2008/07/23 16:50 3.596.288 ---- aw C: \ WINDOWS \ system32 \ qt-dx331.dll
2008/07/23 16:50 129,784 ------ w C: \ WINDOWS \ system32 \ pxafs.dll
2008/07/23 16:50 120,056 ------ w C: \ WINDOWS \ system32 \ pxcpyi64.exe
2008/07/23 16:50 118,520 ------ w C: \ WINDOWS \ system32 \ pxinsi64.exe
2008/07/23 16:48 200,704 ---- aw C: \ WINDOWS \ system32 \ ssldivx.dll
2008/07/23 16:48 1.044.480 ---- aw C: \ WINDOWS \ system32 \ libdivx.dll
2008/07/23 16:46 12,288 ---- aw C: \ WINDOWS \ system32 \ DivXWMPExtType.dll
2008/07/21 13:33 890,828 - sha-w C: \ WINDOWS \ system32 \ hgillUtv.ini2
2008/07/21 10:06 10,520 ---- aw C: \ WINDOWS \ system32 \ avgrsstx.dll
2008/07/18 20:10 94,920 ---- aw C: \ WINDOWS \ system32 \ cdm.dll
2008/07/18 20:10 53,448 ---- aw C: \ WINDOWS \ system32 \ wuauclt.exe
2008/07/18 20:10 45,768 ---- aw C: \ WINDOWS \ system32 \ wups2.dll
2008/07/18 20:10 36,552 ---- aw C: \ WINDOWS \ system32 \ wups.dll
2008/07/18 20:09 563,912 ---- aw C: \ WINDOWS \ system32 \ wuapi.dll
2008/07/18 20:09 325,832 ---- aw C: \ WINDOWS \ system32 \ wucltui.dll
2008/07/18 20:09 205,000 ---- aw C: \ WINDOWS \ system32 \ wuweb.dll
2008/07/18 20:09 1.811.656 ---- aw C: \ WINDOWS \ system32 \ Wuaueng.dll
2008/07/18 20:07 210,976 ---- aw C: \ WINDOWS \ system32 \ muweb.dll
2008-07-18 14:29 77 ---- aw C: \ Documents and Settings \ Administrador \ 2064.bat
2008/07/07 20:26 253,952 ---- aw C: \ WINDOWS \ system32 \ Es.dll
2008/06/24 16:43 74,240 ---- aw C: \ WINDOWS \ system32 \ mscms.dll
2008/06/23 16:57 826,368 ---- aw C: \ WINDOWS \ system32 \ wininet.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))) ))))))))))))))))))))))))))))))))))))))))
.
.
* Nota * entradas vazias & legit entradas padrão não são mostrados
REGEDIT4
[HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ actuais ntVersion \ Run]
"CTFMON.EXE" = "C: \ WINDOWS \ system32 \ ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Run]
"SynTPEnh" = "C: \ Program Files \ Synaptics \ SynTP \ SynTPEnh.exe" [2006-03-08 761947]
"Broadcom Wireless Manager UI" = "C: \ WINDOWS \ system32 \ WLTRAY.exe" [2007-03-16 1392640]
"StartCCC" = "C: \ Program Files \ ATI Technologies \ ATI.ACE \ Core-Static \ CLIStart.exe" [2006-11-10 90112]
"SunJavaUpdateSched" = "C: \ Program Files \ Java \ jre1.6.0_06 \ bin \ jusched.exe" [2008-03-25 144784]
"RoxioDragToDisc" = "C: \ Program Files \ Roxio \ Easy Media Creator 7 \ Drag a Disc \ DrgToDsc.exe" [2004-01-27 1179648]
"QuickTime Task" = "C: \ Program Files \ QuickTime \ QTTask.exe" [2008-05-27 413696]
"SiteAdvisor" = "C: \ Program Files \ SiteAdvisor \ 6261 \ SiteAdv.exe" [2007-06-21 36640]
"McENUI" = "C: \ PROGRA ~ 1 \ McAfee \ MHN \ McENUI.exe" [2007-11-30 1164576]
"mcagent_exe" = "C: \ Program Files \ McAfee.com \ Agent \ mcagent.exe" [2007-11-01 582992]
"SigmatelSysTrayApp" = "stsystra.exe" [2006/02/10 C: \ WINDOWS \ stsystra.exe]
[HKEY_USERS \. DEFAULT \ Software \ Microsoft \ Windows \ Cur rentVersion \ Run]
"CTFMON.EXE" = "C: \ WINDOWS \ system32 \ CTFMON.EXE" [2008-04-14 15360]
[HKEY_USERS \. DEFAULT \ Software \ Microsoft \ Windows \ Cur rentVersion \ RunOnce]
"WUAppSetup" = "C: \ Program Files \ Common Files \ logishrd \ WUApp32.exe" [2007-02-04 435736]
[HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Security Center]
"AntiVirusDisableNotify" = dword: 00000001
[HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Security Center \ Monitoring \ McAfeeAntiVirus]
"DisableMonitoring" = dword: 00000001
[HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Security Center \ Monitoring \ McAfeeFirewall]
"DisableMonitoring" = dword: 00000001
[HKLM \ ~ \ Services \ SharedAccess \ Parameters \ firewallpo licy \ standardprofile \ AuthorizedApplications \ List]
"% windir% \ \ system32 \ \ Sessmgr.exe" =
"% windir% \ \ Network Diagnostic \ \ xpnetdiag.exe" =
"C: \ \ Arquivos de Programas \ \ Messenger \ \ msmsgs.exe" =
"C: \ \ Arquivos de Programas \ \ Windows Live \ \ Messenger \ \ msnmsgr.exe" =
"C: \ \ Arquivos de Programas \ \ Windows Live \ \ Messenger \ \ livecall.exe" =
"C: \ \ Arquivos de Programas \ \ LimeWire \ \ LimeWire.exe" =
"C: \ \ Arquivos de Programas \ \ Arquivos comuns \ \ McAfee \ \ MNA \ \ McNASvc.exe" =
"C: \ \ Arquivos de Programas \ \ Skype \ \ Phone \ \ Skype.exe" =
S1 AvgLdx86; AVG Free AVI Loader Driver x86; C: \ WINDOWS \ system32 \ Drivers \ avgldx86.sys [2008-07-21 96520]
S4 avg8wd; AVG Free8 Watchdog, C: \ PROGRA ~ 1 \ AVG \ AVG8 \ avgwdsvc.exe []
* Serviço recém-criado * - CatchMe
* Serviço recém-criado * - PROCEXP90
.
Conteúdo da 'Tarefas agendadas' pasta
.
- - - - ÓRFÃOS REMOVIDO - - - --
HKCU-Run-LogitechSetup - D: \ Setup \ Setup.exe

.
Scan Suplementar ------- -------
.
FireFox -: Profile - C: \ Documents and Settings \ Administrador \ Application Data \ Mozilla \ Firefox \ Profiles \ aqi5r52b.default \
.
************************************************** ************************
CatchMe 0.3.1361 W2K/XP/Vista - rootkit / stealth malware detector por Gmer, http://www.gmer.net
Rootkit scan 2008-09-23 04:09:28
5/1/2600 Windows Service Pack 3 NTFS
digitalizar processos escondidos ...
escaneamento automático entradas escondidas ...
digitalizar os arquivos ocultos ...
varredura foi concluída com êxito
ficheiros ocultos: 0
************************************************** ************************
.
Conclusão tempo: 2008/09/23 4:10:26
ComboFix-quarantined-files.txt 2008-09-23 02:10:23
Pré-Run: 62363549696 bytes livres
Post-Run: 62437605376 bytes livres
153 --- EOF --- 2008-09-22 20:32:15
*
*
*
*
Então, eu corri esta hijack novamente

*
*
Logfile da Trend Micro HijackThis v2.0.2
Scan guardado em 4:11:27, em 9/23/2008
Plataforma: Windows XP SP3 (WinNT 5/01/2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Executando processos:
C: \ WINDOWS \ System32 \ smss.exe
C: \ WINDOWS \ system32 \ winlogon.exe
C: \ WINDOWS \ system32 \ Services.exe
C: \ WINDOWS \ system32 \ lsass.exe
C: \ WINDOWS \ system32 \ Ati2evxx.exe
C: \ WINDOWS \ system32 \ svchost.exe
C: \ Program Files \ Windows Defender \ MsMpEng.exe
C: \ WINDOWS \ System32 \ svchost.exe
C: \ WINDOWS \ system32 \ Ati2evxx.exe
C: \ WINDOWS \ System32 \ WLTRYSVC.EXE
C: \ WINDOWS \ System32 \ bcmwltry.exe
C: \ WINDOWS \ system32 \ spoolsv.exe
C: \ PROGRA ~ 1 \ McAfee \ MSC \ mcmscsvc.exe
c: \ Program Files \ Common Files \ McAfee \ MNA \ mcnasvc.exe
c: \ PROGRA ~ 1 \ common ~ 1 \ mcafee \ mcproxy \ mcproxy.exe
C: \ Program Files \ McAfee \ VirusScan \ Mcshield.exe
C: \ Program Files \ McAfee \ MPF \ MPFSrv.exe
C: \ Program Files \ SiteAdvisor \ 6261 \ SAService.exe
C: \ WINDOWS \ system32 \ svchost.exe
c: \ PROGRA ~ 1 \ mcafee.com \ agent \ mcagent.exe
C: \ WINDOWS \ stsystra.exe
C: \ Program Files \ Synaptics \ SynTP \ SynTPEnh.exe
C: \ WINDOWS \ system32 \ WLTRAY.exe
C: \ Program Files \ Java \ jre1.6.0_06 \ bin \ jusched.exe
C: \ Program Files \ Roxio \ Easy Media Creator 7 \ Drag a Disc \ DrgToDsc.exe
C: \ Program Files \ ATI Technologies \ ATI.ACE \ Core-Static \ MOM.EXE
C: \ Program Files \ SiteAdvisor \ 6261 \ SiteAdv.exe
C: \ Program Files \ Windows Defender \ MSASCui.exe
C: \ WINDOWS \ system32 \ ctfmon.exe
C: \ Program Files \ ATI Technologies \ ATI.ACE \ Core-Static \ ccc.exe
c: \ PROGRA ~ 1 \ mcafee \ msc \ mcuimgr.exe
C: \ WINDOWS \ system32 \ Imapi.exe
C: \ WINDOWS \ system32 \ notepad.exe
C: \ WINDOWS \ explorer.exe
C: \ Desktop \ Trend Micro \ HijackThis \ HijackThis.exe
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - (089FD14D-132B-48FC-8861-0048AE113215) - C: \ Program Files \ SiteAdvisor \ 6261 \ SiteAdv.dll
O2 - BHO: Spybot-S & D IE Protection - (53707962-6F74-2D53-2644-206D7942484F) - C: \ PROGRA ~ 1 \ SpyBot ~ 1 \ SDHelper.dll
O2 - BHO: SSVHelper Class - (761497BB-D6F0-462C-B6EB-D4DAF1D92D43) - C: \ Program Files \ Java \ jre1.6.0_06 \ bin \ ssv.dll
O2 - BHO: Windows Live Sign-in Helper - (9030D464-4C02-4ABF-8ECC-5164760863C6) - C: \ Program Files \ Common Files \ Microsoft Shared \ Windows Live \ WindowsLiveLogin.dll
O3 - Toolbar: McAfee SiteAdvisor - (0BF43445-2F28-4351-9252-17FE6E806AA0) - C: \ Program Files \ SiteAdvisor \ 6261 \ SiteAdv.dll
O4 - HKLM \ .. \ Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM \ .. \ Run: [SynTPEnh] C: \ Program Files \ Synaptics \ SynTP \ SynTPEnh.exe
O4 - HKLM \ .. \ Run: [Broadcom Wireless Manager UI] C: \ WINDOWS \ system32 \ WLTRAY.exe
O4 - HKLM \ .. \ Run: [StartCCC] "C: \ Program Files \ ATI Technologies \ ATI.ACE \ Core-Static \ CLIStart.exe"
O4 - HKLM \ .. \ Run: [SunJavaUpdateSched] "C: \ Program Files \ Java \ jre1.6.0_06 \ bin \ jusched.exe"
O4 - HKLM \ .. \ Run: [RoxioDragToDisc] "C: \ Program Files \ Roxio \ Easy Media Creator 7 \ Drag a Disc \ DrgToDsc.exe"
O4 - HKLM \ .. \ Run: [QuickTime Task] "C: \ Program Files \ QuickTime \ QTTask.exe"-atboottime
O4 - HKLM \ .. \ Run: [SiteAdvisor] "C: \ Program Files \ SiteAdvisor \ 6261 \ SiteAdv.exe"
O4 - HKLM \ .. \ Run: [McENUI] C: \ PROGRA ~ 1 \ McAfee \ MHN \ McENUI.exe / ocultar
O4 - HKLM \ .. \ Run: [mcagent_exe] C: \ Program Files \ McAfee.com \ Agent \ mcagent.exe / runkey
O4 - HKCU \ .. \ Run: [CTFMON.EXE] C: \ WINDOWS \ system32 \ ctfmon.exe
O4 - HKUS \ S-1-5-19 \ .. \ Run: [CTFMON.EXE] C: \ WINDOWS \ system32 \ CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS \ S-1-5-20 \ .. \ Run: [CTFMON.EXE] C: \ WINDOWS \ system32 \ CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS \ S-1-5-18 \ .. \ Run: [CTFMON.EXE] C: \ WINDOWS \ system32 \ CTFMON.EXE (User 'SYSTEM')
O4 - HKUS \ S-1-5-18 \ .. \ RunOnce: [WUAppSetup] C: \ Program Files \ Common Files \ logishrd \ WUApp32.exe-v 0x08d9-p 0x046d vídeo-f-m-d logitech 10.5. 1,2023 (User 'SYSTEM')
O4 - HKUS \. DEFAULT \ .. \ Run: [CTFMON.EXE] C: \ WINDOWS \ system32 \ CTFMON.EXE (User 'Default user')
O4 - HKUS \. DEFAULT \ .. \ RunOnce: [WUAppSetup] C: \ Program Files \ Common Files \ logishrd \ WUApp32.exe-v 0x08d9-p 0x046d vídeo-f-m-d logitech 10.5.1.2023 (User 'Default usuário ')
O8 - Extra context menu item: E & xportar para o Microsoft Excel - res: / / C: \ PROGRA ~ 1 \ MICROS ~ 3 \ OFFICE11 \ EXCEL.EXE/3000
O9 - Extra button: (no name) - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_06 \ bin \ ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_06 \ bin \ ssv.dll
O9 - Extra button: Skype - (77BF5300-1474-4EC7-9980-D32B190E9B07) - C: \ WINDOWS \ system32 \ shdocvw.dll
O9 - Extra button: Research - (92780B25-18CC-41C8-B9BE-3C9C571A8263) - C: \ PROGRA ~ 1 \ MICROS ~ 3 \ OFFICE11 \ REFIEBAR.DLL
O9 - Extra button: (no name) - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ PROGRA ~ 1 \ SpyBot ~ 1 \ SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ PROGRA ~ 1 \ SpyBot ~ 1 \ SDHelper.dll
O9 - Extra button: Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe
O16 - DPF: (6E32070A-766D-4EE6-879C-DC1FA91D2FC3) (MUWebControl Class) -- http://update.microsoft.com/microsof...?1222115615015
O18 - Protocol: skype4com - (FFC8B962-9B40-4DFF-9458-1830C7DD7F5D) - C: \ PROGRA ~ 1 \ common ~ 1 \ Skype \ SKYPE4 ~ 1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C: \ WINDOWS \ system32 \ Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C: \ WINDOWS \ system32 \ ati2sgag.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C: \ Program Files \ Common Files \ LogiShrd \ SrvLnch \ SrvLnch.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C: \ PROGRA ~ 1 \ McAfee \ MSC \ mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c: \ Program Files \ Common Files \ McAfee \ MNA \ mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C: \ PROGRA ~ 1 \ McAfee \ VIRUSS ~ 1 \ mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c: \ PROGRA ~ 1 \ common ~ 1 \ mcafee \ mcproxy \ mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C: \ Program Files \ McAfee \ VirusScan \ Mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C: \ Program Files \ McAfee \ MPF \ MPFSrv.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C: \ Program Files \ SiteAdvisor \ 6261 \ SAService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C: \ WINDOWS \ System32 \ WLTRYSVC.EXE
--
Fim do processo - 6865 bytes

.... quaisquer ideias ainda?

**evilfantasy** · #6 22. Set 2008, 19:46

Tudo parece bem agora. Quais os problemas que você ainda está tendo?

----------

Baixar CCleaner Slim e guardá-la para o seu desktop.
Quando o arquivo foi salvo, vá para o seu desktop e dê um duplo clique sobre ccsetupxxx_slim.exe
Siga as instruções para instalar o programa.
Complete a instalação em seguida:

Dê um duplo clique no CCleaner atalho na área de trabalho para iniciar o programa.
Clique sobre a Opções bloco de esquerda, em seguida, escolha Cookies.
- Sob Excluir cookies para, Realce quaisquer cookies que você gostaria de manter permanentemente
- Clique na seta direita > para movê-las para o "Cookies" para manter janela.
Vá em Opções > Avançado unverificar Apenas apagar arquivos no Windows Temp pastas com mais de 48 horas
Clique Limpador à esquerda, em seguida, Executar Cleaner sobre o direito de executar o programa.
Importante: Certifique-se de que TODOS janelas do navegador estão fechados antes de escolher Executar Cleaner
Cuidado: Não é recomendado que você use o "Registro" recurso a menos que você esteja muito familiarizado com o registro.
Sair CCleaner depois de ter concluído o seu processo.

----------

O seu Java está desatualizado.

As versões mais antigas têm vulnerabilidades que sites maliciosos podem usar para infectar seu sistema.

Primeiro instale a nova Sun Java Runtime Environment

Certifique-se de fechar todas as janelas do navegador antes de iniciar a instalação.

Remover a versão antiga (s)

Download JavaRa e descompacte o arquivo para o seu desktop.
Abrir JavaRA.exe e escolha Remover as versões mais antigas
Uma vez concluída JavaRA saída e apagar o programa.
Executar CCleaner.

----------

Baixar Desativar ou remover o Windows Messenger para o Desktop para remover Windows Messenger.

Não confunda Windows Messenger com MSN Messenger porque eles não são os mesmos. Windows Messenger é uma causa freqüente de pop-ups.

Descompacte o arquivo no desktop. Abra o MessengerDisable.exe e escolher o fundo caixa -- Desinstalar o Windows Messenger e clique em Aplicar.

Sair fora de MessengerDisable em seguida, elimine os dois arquivos que foram colocados no desktop.