tocobits

Olá pessoal tudo beleza,
Peguei este virus instalando o Kazaa Media Desktop.
Gostaria de saber de vcs, com eliminar este virus win32.trojan-gen
e qual e o maleficio que ele causa na maquina.
Desde ja agradeco a vcs.

jqueiroz

Precisamos saber qual o seu Windows e qual o seu antivírus. Sem essas informações, fica difícil te ajudar.

__________________

tocobits

É o win 98 e o antivirus e o avast!!!!

vit

Se eu nao me engano eliminei ele com o avg, ja tentou...

jqueiroz

Tenta limpar com um Anti-Spyware, como o AdAware, o Spybot ou o HijackThis.

__________________

tocobits

A pricípio o problema resolveu. Instalei o Webroot Spy Sweeper conseguiu
remover o arquivo que o virus está anexado, só que o arquivo necessita para o seu funcionamento do kazaa e o que acontece com o avast ele remove o arquivo em vez de repara-lo, e quando foi inicializar o Kazaa não foi possível.

jqueiroz

Bem, o Kazaa tem disso: se vc quiser ele, tem que levar o "contrapeso".

Considere outras alternativas de P2P...

__________________

farizeu_2006

Amigos...Gostaria de saber como retirar o virus Trojan-gen do meu PC.
Valeu antecipadamente !!!e gostaria de saber pra onde vcs vao mandar a dicar pra mim retirar o virus. Meu windows é XP e o antivirus Avast

Beto Bass

Olá, estou com problemas com esse trojan tb...
no meu caso, já baixei o avg anti-spyware, já tinha instalado o spyware doctor, e tenho instalado o avast. qndo inicio meu micro, o avast acusa q um arquivo, mchinjdrv.sys, está infectado, e aconselha mandar para a quarentena. no caso, eu clico sem ação, para poder passar o avg. mas qndo eu mando ele naum ter ação, esse arquivo some, e em nenhuma varredura ele consta. tenho q fazer isso no modo de segurança? aliás, não estou conseguindo dar boot em modo de segurança.
bom, obrigado pela atenção!

Vivizinha sakua

Oi meu anti-virus detectou alguns cavalos de tróia aki no meu pc como faço para remove-los sem causar nenhum dano. Meu pc é win xp profisional e meu anti vírus é o avast.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:25:40, on 9/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe
C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Arquivos de programas\Software WIDCOMM\Bluetooth\bin\btwdins.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe
C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe
C:\ARQUIV~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
C:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\wt\updater\wcmdmgr.exe
C:\WINDOWS\mngrss.exe
C:\Arquivos de programas\Spyware Terminator\SpywareTerminatorShield.exe
C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe
C:\Arquivos de programas\Software WIDCOMM\Bluetooth\BTTray.exe
C:\Arquivos de programas\RALINK\Common\RaUI.exe
C:\Arquivos de programas\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe
C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe
C:\Arquivos de programas\MSN Messenger\usnsvc.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://br.yahoo.com
R3 - URLSearchHook: Barra de Ferramentas do Yahoo! com bloqueador de pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44CF-8957-5838F569A31D} - C:\Arquivos de programas\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Arquivos de programas\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\ARQUIV~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch
O4 - HKLM\..\Run: [mngrss] C:\WINDOWS\mngrss.exe
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Arquivos de programas\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\ARQUIV~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKCU\..\Run: [slide.exe] c:\arquivos de programas\slide\slide.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: pdf.exe
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Arquivos de programas\RALINK\Common\RaUI.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...rch.jhtml?p=ZN
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Enviar para &Bluetooth - C:\Arquivos de programas\Software WIDCOMM\Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Arquivos de programas\Software WIDCOMM\Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Arquivos de programas\Software WIDCOMM\Bluetooth\btsendto_ie.htm
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Arquivos de programas\Software WIDCOMM\Bluetooth\bin\btwdins.exe
O23 - Service: OneStep Search Service - OneStepSearch.net, Inc. - C:\Arquivos de programas\OneStepSearch\onestep.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Arquivos de programas\Spyware Terminator\sp_rsser.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Arquivos de programas\Windows Live\installer\WLSetupSvc.exe
--
End of file - 7009 bytes

Wings

Citação:
Baixe o programa hijackthis do link abaixo e faça um, scan. Cole o resultado aqui.
http://www.trendsecure.com/portal/en...HiJackThis.zip

jqueiroz

Movido de "Redes e Internet" para a sala "Segurança: Vírus & Etc.".

__________________

samsty

Ei colega, porque vc nao usa o ares para baixar arquivos, depois que passei a utilizá-lo nao tive problemas com virus via estes arquivos.

janamiceli

por favor me ajudem!!!!mts virus ,o pc e novo e ta mt ruim,nenhum site fica por mais de 2 minutos e nem msn entra!!!Logfile of Trend Micro HijackThis v2.0.2Scan saved at 00:55:01, on 20/12/2007Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\s ystem32\winlogon.exeC:\WINDOWS\system32\services.e xeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32 \svchost.exeC:\WINDOWS\System32\svchost.exeC:\Arqu ivos de programas\Alwil Software\Avast4\aswUpdSv.exeC:\Arquivos de programas\Alwil Software\Avast4\ashServ.exeC:\WINDOWS\system32\spo olsv.exeC:\Arquivos de programas\Arquivos comuns\System\ati.exeC:\WINDOWS\System32\dllcache\ vndovss.exeC:\WINDOWS\System32\dllcache\wintcpack. exeC:\Arquivos de programas\PCS-65\RedHanded.Net 2.4.0\pcln65.exeC:\WINDOWS\System32\svchost.exeC:\ Arquivos de programas\Alwil Software\Avast4\ashWebSv.exeC:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exeC:\WINDOWS\System32\dl lcache\windmns.exeC:\WINDOWS\System32\dllcache\ibm psw.exeC:\WINDOWS\System32\spool\drivers\w32x86\3\ hpztsb10.exeC:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exeC:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exeC:\Arquivos de programas\Analog Devices\Core\smax4pnp.exeC:\ARQUIV~1\ALWILS~1\Avas t4\ashDisp.exeC:\WINDOWS\System32\Win.exeC:\WINDOW S\System32\msmsngers.exeC:\WINDOWS\System32\wbcmgr .exeC:\WINDOWS\System32\wbcmgr.exeC:\WINDOWS\Syste m32\ntcupi.exeC:\WINDOWS\System32\eXtream.exeC:\WI NDOWS\System32\lqnovef.exeC:\WINDOWS\System32\type .exeC:\WINDOWS\System32\msmsgers.exeC:\WINDOWS\Sys tem32\LTQ.EXEC:\WINDOWS\System32\ctfmon.exeC:\Arqu ivos de programas\MSN Messenger\msnmsgr.exeC:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolb arNotifier.exeC:\Arquivos de programas\Messenger\msmsgs.exeC:\WINDOWS\System32\ LTQ.EXEC:\Arquivos de programas\Internet Explorer\IEXPLORE.EXEC:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WLLoginProxy.exeC:\WINDOWS\System32\LTQ.EXEC: \WINDOWS\System32\LTQ.EXEC:\WINDOWS\explorer.exeC: \WINDOWS\System32\LTQ.EXEC:\Documents and Settings\Administrador\Configurações locais\Temp\Diretório temporário 1 para HiJackThis.zip\HijackThis.exeC:\Documents and Settings\Administrador\Configurações locais\Temp\Diretório temporário 2 para HiJackThis.zip\HijackThis.exeC:\WINDOWS\system32\N OTEPAD.EXEC:\WINDOWS\System32\dllcache\ibmpsw.exeC :\WINDOWS\System32\dllcache\windmns.exeR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.aspF2 - REG:system.ini: Shell=Explorer.exe %WINDIR%\VTTray.exeO2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dllO2 - BHO: (no name) - {73E00092-5539-4661-9B61-3A66FC0D772E} - C:\WINDOWS\system32\nnnkjgh.dllO2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar1.dllO2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\2.0.301.716 4\swg.dllO2 - BHO: (no name) - {C8C4C1DA-0EAF-46DF-A30C-DB79155931CE} - C:\WINDOWS\System32\ssttt.dllO2 - BHO: {2ea61dbe-4f4c-75e9-0f84-c4064c3ba8fe} - {ef8ab3c4-604c-48f0-9e57-c4f4ebd16ae2} - C:\WINDOWS\System32\krbrkqfa.dllO3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar1.dllO4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb1 0.exeO4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"O4 - HKLM\..\Run: [OfficeWord Monitors] C:\WINDOWS\System32\Offlce.exeO4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exeO4 - HKLM\..\Run: [SoundMAX] "C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe" /trayO4 - HKLM\..\Run: [SoundMAXPnP] C:\Arquivos de programas\Analog Devices\Core\smax4pnp.exeO4 - HKLM\..\Run: [Windows Secure Update] load.exeO4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKLM\..\Run: [smsger] C:\WINDOWS\System32\Win.exeO4 - HKLM\..\Run: [kiss] C:\Arquivos de programas\killSh\pingy.exeO4 - HKLM\..\Run: [MicroSoft ssadsadas3s1] eXtream.exeO4 - HKLM\..\Run: [Internet] C:\WINDOWS\System32\msmsngers.exeO4 - HKLM\..\Run: [Wbcmgr] wbcmgr.exeO4 - HKLM\..\Run: [Windows Services Aganter] ntcupi.exeO4 - HKLM\..\Run: [Windows LoL Layer] lqnovef.exeO4 - HKLM\..\Run: [Microsoft Update] type.exeO4 - HKLM\..\Run: [msmsger] C:\WINDOWS\System32\msmsgers.exeO4 - HKLM\..\Run: [Winsock2 driver] LTQ.EXEO4 - HKLM\..\Run: [4c5a3941] rundll32.exe "C:\WINDOWS\System32\viqvnpjx.dll",bO4 - HKLM\..\RunServices: [Windows Secure Update] load.exeO4 - HKLM\..\RunServices: [smsger] C:\WINDOWS\System32\Win.exeO4 - HKLM\..\RunServices: [MicroSoft ssadsadas3s1] eXtream.exeO4 - HKLM\..\RunServices: [Internet] C:\WINDOWS\System32\msmsngers.exeO4 - HKLM\..\RunServices: [Windows Services Aganter] ntcupi.exeO4 - HKLM\..\RunServices: [Windows LoL Layer] lqnovef.exeO4 - HKLM\..\RunServices: [Microsoft Update] type.exeO4 - HKLM\..\RunServices: [msmsger] C:\WINDOWS\System32\msmsgers.exeO4 - HKLM\..\RunOnce: [MicroSoft ssadsadas3s1] eXtream.exeO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exeO4 - HKCU\..\Run: [MicroSoft ssadsadas3s1] eXtream.exeO4 - HKCU\..\Run: [Windows Services Aganter] ntcupi.exeO4 - HKCU\..\Run: [Windows LoL Layer] lqnovef.exeO4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolb arNotifier.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\RunOnce: [Winsock2 driver] LTQ.EXEO4 - HKCU\..\RunOnce: [MicroSoft ssadsadas3s1] eXtream.exeO4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')O4 - HKUS\S-1-5-21-1202660629-1604221776-725345543-500\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe (User '?')O4 - HKUS\S-1-5-21-1202660629-1604221776-725345543-500\..\Run: [Windows LoL Layer] lqnovef.exe (User '?')O4 - HKUS\S-1-5-21-1202660629-1604221776-725345543-500\..\Run: [msnmsgr] "C:\Arquivos de programas\MSN Messenger\msnmsgr.exe" /background (User '?')O4 - HKUS\S-1-5-21-1202660629-1604221776-725345543-500\..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolb arNotifier.exe (User '?')O4 - HKUS\S-1-5-21-1202660629-1604221776-725345543-500\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background (User '?')O4 - HKUS\S-1-5-21-1202660629-1604221776-725345543-500\..\RunOnce: [Winsock2 driver] LTQ.EXE (User '?')O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')O4 - HKUS\S-1-5-18\..\RunOnce: [Windows Secure Update] load.exe (User '?')O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')O4 - HKUS\.DEFAULT\..\RunOnce: [Windows Secure Update] load.exe (User 'Default user')O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htmO9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htmO10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dllO14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/ac...llinone.aspO16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/Ac...MSDcode.cabO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...ab56986.cabO16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.update.microsoft.com/...93014164343O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/PT-BR/...ME_UNO1.cabO16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...ab56907.cabO16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cabO20 - Winlogon Notify: nnnkjgh - C:\WINDOWS\SYSTEM32\nnnkjgh.dllO20 - Winlogon Notify: xxywwwx - C:\WINDOWS\SYSTEM32\xxywwwx.dllO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exeO23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exeO23 - Service: Explorer - Unknown owner - C:\Arquivos de programas\Arquivos comuns\System\ati.exeO23 - Service: Google Updater Service (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: IBM Access Driver Control - Unknown owner - C:\WINDOWS\System32\dllcache\ibmpsw.exeO23 - Service: Microsoft Agent - Unknown owner - C:\WINDOWS\System32\dllcache\vndovss.exeO23 - Service: Microsoft Windows DNS Manager - Unknown owner - C:\WINDOWS\System32\dllcache\windmns.exeO23 - Service: Microsoft Windows TCP Ack Timing - Unknown owner - C:\WINDOWS\System32\dllcache\wintcpack.exeO23 - Service: RdLst65 - Unknown owner - C:\Arquivos de programas\PCS-65\RedHanded.Net 2.4.0\pcln65.exeO23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Arquivos de programas\WinPcap\rpcapd.exeO23 - Service: s3contrl (32-bit) - Unknown owner - C:\WINDOWS\VTTray.exe (file missing)--End of file - 10928 bytes

janamiceli

alguem pode ajudar a retirar essa infinidade de virus????

Wings

Há muito bicho aí!!!

Vamos nós:

1.
*Faça o download da ferramenta no link abaixo e salve-a no Desktop:
http://linhadefensiva.uol.com.br/dl/bankerfix
*Baixe o programa do link e salve-o no desktop
http://www.symantec.com/content/es/m...s/FixVundo.exe
*Faça o download do VundoFix e salve-o no desktop
http://www.atribune.org/ccount/click.php?id=4
*Anote todo o procedimento
*Desconecte-se da internet...todo o procedimento será feito sem a conexão!!
*Desative temporariamente seu antivírus e anti-spyware
*Duplo clique no arquivo bankerfix.exe.
*Clique OK > SIM (se pedir alguma atualização) > OK
*Tecle ENTER e aguarde.
*Ao encerrar leia a mensagem da tela e tecle ENTER

2.
*Duplo clique em VundoFix.exe
*Quando o VundoFix abrir,novamente, clique em Scan for Vundo
*Ao terminar, clique em Remove Vundo.
*Surgirá um prompt perguntando se quer remover os arquivos. Confirme!
*Sua área de trabalho vai desaparecer!...é normal
*Surgirá um aviso dizendo que seu computador deve ser desligado.
*Clique em OK e depois,ligue o computador novamente!
*É possível que o VundoFix encontre um arquivo, mas não consiga removê-lo. Se isso acontecer, a ferramenta rodará ao reiniciar.
*Quando o VundoFix aparecer, clique no botão Scan for Vundo para repetir o processo.
*Volte a desativar temporariamente se antivírus e anti-spyware

3.
*Reinicie o PC em Modo de Segurança (aperte F8 durante a inicialização e na tela de menu de opções selecione Modo Seguro)
*Duplo clique em FixVundo.exe
*Aguarde o término do procedimento
*Reinicie o PC em Modo Normal

4.
*Conecte-se novamente na internet
*Faça um scan online em http://www.pandasoftware.com/actives..._principal.htm
*Ao finalizar o scan cole aqui o resultado do scan online, os resultados criados em C:\fixvundo.txt,, C:\Vundofix.txt, C:\LinhaDefensiva\relatorio.txt e novo log do hijack (procure criar um log do hijack melhor!!!...este está muito bagunçado).

Rubens Kamimura

Olá colegas peguei alguns cavalos de tróia. uso win xp e o avast, gostaria de saber o que podemos fazer sem danificar ... abaixo segue: arquivo hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:51:12, on 2/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe
C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe
C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe
C:\Arquivos de programas\Java\jre1.6.0_03\bin\jusched.exe
C:\Arquivos de programas\iTunes\iTunesHelper.exe
C:\WINDOWS\vsnpstd.exe
C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\WINDOWS\system32\orkutkut.exe
C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe
C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe
C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Arquivos de programas\BOINC\boincmgr.exe
C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexStoreSvr.exe
C:\Arquivos de programas\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe
C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe
C:\Arquivos de programas\iPod\bin\iPodService.exe
C:\Arquivos de programas\BOINC\boinc.exe
C:\WINDOWS\System32\svchost.exe
C:\Arquivos de programas\BOINC\projects\setiathome.berkeley.edu\s etiathome_5.27_windows_intelx86.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Arquivos de programas\Mozilla Firefox\firefox.exe
C:\Arquivos de programas\WinRAR\WinRAR.exe
C:\DOCUME~1\1-RUBE~1\CONFIG~1\Temp\Rar$EX01.609\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1046
R3 - URLSearchHook: Barra de Ferramentas do Yahoo! com bloqueador de pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ADSTechnology module - {831CBAC0-8283-4653-9D81-FEB9F3F6E47C} - C:\Arquivos de programas\ADSTechnology\ADSTechnology.dll
O2 - BHO: ActivationManager module - {86A44EF7-78FC-4e18-A564-B18F806F7F56} - C:\Arquivos de programas\ActivationManager\ActivationManager.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\2.0.301.716 4\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Arquivos de programas\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar1.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Arquivos de programas\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Arquivos de programas\CyberLink\PowerDVD\Language\Language.exe "
O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Arquivos de programas\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [GlobalFlagorkutkut] C:\WINDOWS\system32\orkutkut.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-21-1482476501-115176313-682003330-1007\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '3 - Fabio')
O4 - HKUS\S-1-5-21-1482476501-115176313-682003330-1007\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe" (User '3 - Fabio')
O4 - HKUS\S-1-5-21-1482476501-115176313-682003330-1007\..\Run: [msnmsgr] "C:\Arquivos de programas\MSN Messenger\msnmsgr.exe" /background (User '3 - Fabio')
O4 - HKUS\S-1-5-21-1482476501-115176313-682003330-1007\..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolb arNotifier.exe (User '3 - Fabio')
O4 - HKUS\S-1-5-21-1482476501-115176313-682003330-1007\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background (User '3 - Fabio')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Startup: Ferramenta de Verificação de Mídia do Picture Motion Browser.lnk = C:\Arquivos de programas\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - User Startup: Ferramenta de Verificação de Mídia do Picture Motion Browser.lnk = C:\Arquivos de programas\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: BOINC Manager.lnk = C:\Arquivos de programas\BOINC\boincmgr.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Arquivos de programas\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\MSMSGS.EXE
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/micr...?1191780388953
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1191780367218
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {F09BFD07-20B5-46D8-A6D5-BE4EF22F1F4D} - http://members.driverguide.com/direc...e=toolkit_lite
O17 - HKLM\System\CCS\Services\Tcpip\..\{2AA74882-5C14-4824-BC36-6FB307E5F2D1}: NameServer = 200.204.0.10 200.204.0.138
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Arquivos de programas\iPod\bin\iPodService.exe
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLABR11\webserver\bin\matlabserver.exe
O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

--
End of file - 11917 bytes

abraços; rubens.kamimura@cesp.com.br

Eric Gagulich

Rubens Kamimura,

1. Faça o download da ferramenta BankerFix (by Linha Defensiva)
   
   
2. Desative temporariamente o seu programa antivírus;
   
   
3. Execute o arquivo bankerfix.exe;
   
   
4. Ao ser executado pela primeira vez, será exibido a mensagem: "O BankerFix será agora baixado da Internet. Certifique-se de que sua conexão está funcionando completamente...", clique em "OK";
   
   
5. Clique em "OK" para executar o BankerFix;
   
   
6. Pressione qualquer tecla para continuar;
   
   
7. Ao ser concluído a varredura, leia a mensagem na tela e pressione qualquer tecla para continuar;
   
   
8. Ative novamente o seu programa antivírus;
   
   
9. Em seguida poste aqui o resultado do arquivo gerado relatorio.txt (geralmente localizado na pasta C:\LinhaDefensiva)

0.anonymous

Kaspersky em Português BR...
http://baixaki.ig.com.br/download/Ka...t-Security.htm
------------------------------------------------------------------------------------------------
Um site que aborda temas voltados para segurança, testou recentemente diversos programas de varredura de vírus,
colocando-os para varrer uma máquina com 17.477 vírus e pragas diferentes,
testando assim o poder de busca e eliminação de vírus de cada um.
O resultado revelou a porcentagem de pragas que cada programa conseguiu remover, confira:
1. Kaspersky version 7.0.0.43 beta - 99.23%
2. Kaspersky version 6.0.2.614 - 99.13%
3. Active Virus Shield by AOL version 6.0.0.308 - 99.13%
4. ZoneAlarm with KAV Antivirus version 7.0.337.000 - 99.13%
5. F-Secure 2007 version 7.01.128 - 98.56%
6. BitDefender Professional version 10 - 97.70%
7. BullGuard version 7.0.0.23 - 96.59%
8. Ashampoo version 1.30 - 95.80%
9. AntiVir version 7.03.01.53 Classic - 95.08%
10. eScan version 8.0.671.1 - 94.43%
11. Nod32 version 2.70.32 - 94.00%
12. CyberScrub version 1.0 - 93.27%
13. Avast Professional version 4.7.986 - 92.82%
14. AVG Anti-Malware version 7.5.465 - 92.14%
15. F-Prot ??d?s? 6.0.6.4 - 91.35%
16. McAfee Enterprise version 8.5.0i+AntiSpyware module - 90.65%
17. Panda 2007 version 2.01.00 - 90.06%
18. Norman version 5.90.37 - 88.47%
19. ArcaVir 2007 - 88.24%
20. McAfee version 11.0.213 - 86.13%
21. Norton Professional 2007 - 86.08%
22. Rising AV version 19.19.42 - 85.46%
23. Dr. Web version 4.33.2 - 85.09%
24. Trend Micro Internet Security 2007 version 15.00.1450 - 84.96%
25. Iolo version 1.1.8 - 83.35%
26. Virus Chaser version 5.0a - 79.51%
27. VBA32 version 3.11.4 - 77.66%
28. Sophos Sweep version 6.5.1 - 69.79%
29. ViRobot Expert version 5.0 - 69.53%
30. Antiy Ghostbusters version 5.2.1 - 65.95%
--------------------------

jehcasillas

alguém pode me ajudar?


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:48:05, on 3/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe
C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe
C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe
C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Arquivos de programas\Java\jre1.6.0_03\bin\jusched.exe
C:\Arquivos de programas\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Arquivos de programas\HP\hpcoretech\hpcmpmgr.exe
C:\Arquivos de programas\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\HP\hpcoretech\hpcmpmgr .exe
C:\Arquivos de programas\Java\jre1.6.0_03\bin\jusched .exe
C:\Arquivos de programas\Hewlett-Packard\Digital Imaging\bin\hpotdd01 .exe
C:\Arquivos de programas\Hewlett-Packard\HP Software Update\HPWuSchd .exe
C:\WINDOWS\system32\rundll32.exe
C:\Arquivos de programas\WinRAR\WinRAR.exe
C:\DOCUME~1\noraldo\CONFIG~1\Temp\Rar$EX00.654\Hij ackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp
F3 - REG:win.ini: load=C:\WINDOWS\system32\byvts.exe
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar1.dll
O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb0 9.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Arquivos de programas\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Arquivos de programas\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Arquivos de programas\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask .exe" -atboottime
O4 - HKLM\..\Run: [a422b2ef] rundll32.exe "C:\WINDOWS\system32\jytkjcki.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr .exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Translate - {87680762-4A83-11B4-885B-0000E8ECA40F} - C:\Arquivos de programas\LingoCom\Translator.lnk
O9 - Extra 'Tools' menuitem: LingoWare Translator... - {87680762-4A83-11B4-885B-0000E8ECA40F} - C:\Arquivos de programas\LingoCom\Translator.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {41ACD49D-1974-791A-0981-AA9872721044} - http://200.212.184.212/g_bin/eng/boards_2_0_0_34.cab
O16 - DPF: {4B4513E2-4E57-43DF-9496-FCD37E9DFA64} - http://200.212.184.212/g_bin/eng/navy_2_0_0_29.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1196526194860
O16 - DPF: {A7196C8E-35A5-4FF0-9E46-E28918B5CAF6} - http://200.212.184.212/g_bin/eng/domino_2_0_0_33.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://messenger.zone.msn.com/binary...o.cab56649.cab
O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} - http://200.212.184.212/g_bin/eng/words_2_0_0_50.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} - http://200.212.184.212/g_bin/eng/billard8_2_0_0_35.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Arquivos de programas\Arquivos comuns\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Arquivos de programas\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
--
End of file - 6482 bytes