depois de carregado, o windows (xp sp3) reinicia.

Question

Ae galera, to com um problema parecido com o de algumas pessoas.
Depois de ter colocado um pen drive pingando v&iacute;rus (o nod n&atilde;o detectou) o pc ficou muito esquisito. Assim que ele carrega o windows d&aacute; uma msg 
Generic Host Process for Win32 Services

e depois rapidamente aparece uma tela azul e reinicia.
s&oacute; estou conseguindo us&aacute;-lo no modo de seguran&ccedil;a, como agora.

J&aacute; li alguns posts e pra agilizar vou colocar o log de hijack
se puderem me ajudar agrade&ccedil;o!
Ah, eu de gaiato tbm j&aacute; passei o Malawarebytes, mas acho que pulei algumas etapas. Mesmo assim ele disse ter encontrado 68 amea&ccedil;as. Vou colocar o log tbm.

LOG DO HIJACK:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:27:53, on 29/7/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\csrcs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\Explorer.exe
C:\Arquivos de programas\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\config\systemprofile	auzax.ex  e
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Luiz\Desktop\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32
et.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
F2 - REG:system.ini: Shell=Explorer.exe csrcs.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Arquivos de programas\Winamp Toolbar\winamptb.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Arquivos de programas\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Programa Auxiliar de In&iacute;cio de Sess&atilde;o do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {990F4E75-0E04-470E-ADB0-C6B69A9ABDF6} - c:\windows\system32\pwptpsp.dll (file missing)
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\Arquivos de programas\GbPlugin\gbieh.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Arquivos de programas\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.d ll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Arquivos de programas\Winamp Toolbar\winamptb.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Arquivos de programas\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Arquivos de programas\BitDefender\BitDefender 2010\IEToolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [TdspMaLoader] C:\Arquivos de programas\3DSP\Total Wireless\panel\TdspMaLoader.exe
O4 - HKLM\..\Run: [Control Center] C:\Arquivos de programas\Control Center\CCenter.exe
O4 - HKLM\..\Run: [GrooveMonitor] C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Arquivos de programas\Java\jre6\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [BDWizReg] C:\Arquivos de programas\BitDefender\BitDefender 2010\bdwizreg.exe /complete
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] C:\Arquivos de programas\BitDefender\BitDefender 2010\IEShow.exe
O4 - HKLM\..\Run: [BDAgent] C:\Arquivos de programas\BitDefender\BitDefender 2010\bdagent.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [avgnt] C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe /min
O4 - HKLM\..\RunServices: [csrcs] C:\WINDOWS\system32\csrcs.exe
O4 - HKLM\..\RunOnce: [ GbPluginBb] RunDll32.exe C:\ARQUIV~1\GbPlugin\gbieh.dll,Gbieh
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Arquivos de programas\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe
O4 - HKCU\..\Run: [EPSON Stylus Office T33 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIE EB.EXE /FU C:\WINDOWS\TEMP\E_S855.tmp /EF HKCU
O4 - HKCU\..\Run: [DAEMON Tools Lite] C:\Arquivos de programas\DAEMON Tools Lite\daemon.exe -autorun
O4 - HKCU\..\Run: [msnmsgr] C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe /background
O4 - HKCU\..\Run: [siede] C:\Documents and Settings\Luiz\siede.exe
O4 - HKCU\..\Run: [yaomiq] C:\Documents and Settings\Luiz\yaomiq.exe
O4 - HKCU\..\Run: [XA5RJ9EADJ] C:\DOCUME~1\Luiz\CONFIG~1\Temp\Yd3.exe
O4 - HKCU\..\Run: [Fxucipul] rundll32.exe C:\WINDOWS\dprclzbn.dll,Startup
O4 - HKCU\..\Run: [heaasul] C:\Documents and Settings\Luiz\heaasul.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1150600.exe -Update -1150600 -Mozilla/5.0_(Windows;_U;_Windows_NT_5.1;_pt-BR;_rv:1.9.0.15)_Gecko/2009101601_Firefox/3.0.15_(.NET_CLR_3.5.30729) -http://meusjogosdemeninas.uol.com.br/jogos/jogos-de-desenhos-animados/a-luta-das-almofadas.jsp
O4 - HKLM\..\Policies\Explorer\Run: [csrcs] C:\WINDOWS\system32\csrcs.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Recorte de tela e Iniciador do OneNote 2007.lnk = C:\Arquivos de programas\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dados de aplicativos\Winamp Toolbar\ieToolbaresources\en-US\local\search.html
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Publicar em Blogue - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Arquivos de programas\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Publicar no Blogue no Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Arquivos de programas\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O15 - Trusted Zone: http://www.bancobrasil.com.br
O15 - Trusted Zone: http://www.bb.com.br
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Arquivos de programas\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1264526067687
O16 - DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} (GbpDistObj Class) - https://www14.bancobrasil.com.br/plugin/GbpDist.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify:  GbPluginBb - C:\Arquivos de programas\GbPlugin\gbieh.dll
O20 - Winlogon Notify: cryptnet32 - cryptnet32.dll (file missing)
O22 - SharedTaskScheduler: Pr&eacute;-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon de cache de categorias de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Programador (AntiVirSchedulerService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira Upgrade Service (AntiVirUpgradeService) - Unknown owner - C:\DOCUME~1\Luiz\CONFIG~1\Temp\AVSETUP_4c50ea99\ba sic\avupgsvc.exe (file missing)
O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Arquivos de programas\Arquivos comuns\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Arquivos de programas\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Gbp Service (GbpSv) -   - C:\ARQUIV~1\GbPlugin\GbpSv.exe
O23 - Service: Google Update Service (GoogleUpdateBeta) - Google Inc - C:\Documents and Settings\Luiz\Configura&ccedil;&otilde;es locais\Dados de aplicativos\Google\Update\GoogleUpdateBeta.exe
O23 - Service: Google Update Service (gupdate1ca51f6cef3e318) (gupdate1ca51f6cef3e318) - Google Inc. - C:\Arquivos de programas\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender S.R.L. - C:\Arquivos de programas\Arquivos comuns\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Arquivos de programas\Eset
od32krn.exe
O23 - Service: Start BT in service - Unknown owner - C:\Arquivos de programas\IVT Corporation\BlueSoleil\StartSkysolSvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Arquivos de programas\BitDefender\BitDefender 2010\vsserv.exe

--
End of file - 12855 bytes

LOG DO Malwarebytes' Anti-Malware 1.46

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Vers&atilde;o da Base de Dados:  4366

Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

29/7/2010 13:29:10
mbam-log-2010-07-29 (13-29-10).txt

Tipo de Verifica&ccedil;&atilde;o:  Verifica&ccedil;&atilde;o Completa  (C:\|)
Objetos escaneados:  205419
Tempo decorrido: 31 minuto(s), 9 segundo(s)

Processos de Mem&oacute;ria Infectados:  1
M&oacute;dulos de Mem&oacute;ria Infectados:  1
Chaves de Registro Infectadas: 11
Valores de Registro Infectados: 4
Itens de Dados no Registro Infectados:  1
Pastas Infectadas:  0
Arquivos Infectados: 50

Processos de Mem&oacute;ria Infectados: 
C:\WINDOWS\system32\csrcs.exe (Trojan.Agent) -> No action taken.

M&oacute;dulos de Mem&oacute;ria Infectados: 
C:\WINDOWS\system32\cryptnet32.dll (Trojan.Tracur) -> No action taken.

Chaves de Registro Infectadas:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic  es\sshnas (Trojan.FraudPack) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\5DR8ZAD8GX (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\MADOWN (Worm.Magania) -> No action taken.
HKEY_CURRENT_USER\Software\M5T8QL3YW3 (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\V71IQL7HI7 (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DRM\amty (Worm.Autorun) -> No action taken.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic  es\GoogleUpdateBeta (Backdoor.IRCBot) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\TG0PTF86JH (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\XA5RJ9EADJ (Trojan.FakeAlert) -> No action taken.

Valores de Registro Infectados:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre  ntVersion\Run\xa5rj9eadj (Trojan.FraudPack) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre  ntVersion\Run\fxucipul (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr  entVersion\Policies\Explorer\Run\csrcs (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr  entVersion\RunServices\csrcs (Trojan.Agent) -> No action taken.

Itens de Dados no Registro Infectados: 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (Explorer.exe csrcs.exe) Good: (Explorer.exe) -> No action taken.

Pastas Infectadas: 
(N&atilde;o foram detectados &iacute;tens maliciosos)

Arquivos Infectados:
C:\Documents and Settings\Luiz\Configura&ccedil;&otilde;es locais\Temp\Yd3.exe (Trojan.FraudPack) -> No action taken.
C:\WINDOWS\dprclzbn.dll (Trojan.Agent) -> No action taken.
C:\12gn6id2.exe (Spyware.OnlineGames) -> No action taken.
C:\1thes92p.exe (Spyware.OnlineGames) -> No action taken.
C:\9rfpp.exe (Spyware.OnlineGames) -> No action taken.
C:\ca.exe (Spyware.OnlineGames) -> No action taken.
C:\chxnxyx.exe (Worm.Taterf) -> No action taken.
C:\f662sjd.exe (Spyware.OnlineGames) -> No action taken.
C:\hc3hvi0.exe (Spyware.OnlineGames) -> No action taken.
C:\i8ikdjwt.exe (Spyware.OnlineGames) -> No action taken.
C:\lhhr8.exe (Spyware.OnlineGames) -> No action taken.
C:
0qls.exe (Spyware.OnlineGames) -> No action taken.
C:pw.exe (Spyware.OnlineGames) -> No action taken.
C:\vgyn6ewc.exe (Spyware.OnlineGames) -> No action taken.
C:\wkimt.exe (Spyware.OnlineGames) -> No action taken.
C:\wyskq6lt.exe (Spyware.OnlineGames) -> No action taken.
C:\xjb3.exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Luiz\4x.exe (Trojan.Agent.Gen) -> No action taken.
C:\Documents and Settings\Luiz\Configura&ccedil;&otilde;es locais\Temp\cvasds0.dll (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Luiz\Configura&ccedil;&otilde;es locais\Temp\cvasds1.dll (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Luiz\Configura&ccedil;&otilde;es locais\Temp\dsoqq1.dll (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Luiz\Configura&ccedil;&otilde;es locais\Temp\EC7.tmp (Rootkit.Dropper) -> No action taken.
C:\Documents and Settings\Luiz\Configura&ccedil;&otilde;es locais\Temp\F908.tmp (Rootkit.Dropper) -> No action taken.
C:\Documents and Settings\Luiz\Configura&ccedil;&otilde;es locais\Temp
odqq0.dll (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Luiz\Configura&ccedil;&otilde;es locais\Temp
odqq1.dll (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Luiz\Configura&ccedil;&otilde;es locais\Temp\PBIr.exe (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Luiz\Configura&ccedil;&otilde;es locais\TempfYC.exe (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Luiz\Configura&ccedil;&otilde;es locais\Temp\sshnas21.dll (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\Luiz\Configura&ccedil;&otilde;es locais\Temp\Yd0.exe (Trojan.Fraudpack) -> No action taken.
C:\Documents and Settings\Luiz\Configura&ccedil;&otilde;es locais\Temp\Yd1.exe (Trojan.FraudPack) -> No action taken.
C:\Documents and Settings\Luiz\Configura&ccedil;&otilde;es locais\Temp\Yd2.exe (Trojan.FraudPack) -> No action taken.
C:\Documents and Settings\Luiz\Configura&ccedil;&otilde;es locais\Temp\Yd4.exe (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\Luiz\Configura&ccedil;&otilde;es locais\Temp\Yd5.exe (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\Luiz\Configura&ccedil;&otilde;es locais\Temp\Yd6.exe (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\Luiz\Configura&ccedil;&otilde;es locais\Temp\Ydz.exe (Trojan.Fraudpack) -> No action taken.
C:\Documents and Settings\Luiz\Configura&ccedil;&otilde;es locais\Temporary Internet Files\Content.IE5\RAL7XYK1\yH39f5f1fdV03f01530002R 5fce92d4102T75c608bfQ00000000901801F002d000aJ10000 601l0416K4e4a14e93180[1] (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Luiz\Configura&ccedil;&otilde;es locais\Temporary Internet Files\Content.IE5\RAL7XYK1\yHffdfd560V03f01530002R 0c8fa02d102Tb3edd616Q00000000901801F002d000aJ10000 601l0416K5a435f6f3180[1] (Trojan.Agent) -> No action taken.
C:\WINDOWS\Ywuwoa.exe (Trojan.FraudPack) -> No action taken.
C:\WINDOWS\Ywuwob.exe (Trojan.Downloader) -> No action taken.
C:\WINDOWS\system32\sshnas21.dll (Trojan.FraudPack) -> No action taken.
C:\dqm.exe (Spyware.OnlineGames) -> No action taken.
C:3fhr.exe (Spyware.OnlineGames) -> No action taken.
C:\yqq8eqil.exe (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\crt.dat (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\cryptnet32.dll (Trojan.Tracur) -> No action taken.
C:\WINDOWS\system32\csrcs.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\shimg.dll (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Luiz\x.exe (Trojan.KillAV) -> No action taken.
C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> No action taken.
C:\WINDOWS\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job (Trojan.Downloader) -> No action taken.

Answer

:) Ol&aacute; Toror&oacute;!

:veja: No seu log do Malwarebytes est&aacute; constando que ele encontrou v&aacute;rios problemas que ainda n&atilde;o foram removidos. Veja que aparece a frase no action taken na frente das amea&ccedil;as, isto &eacute;: nenhuma a&ccedil;&atilde;o foi tomada.

Fa&ccedil;a uma nova verifica&ccedil;&atilde;o completa com o Malwarebytes seguindo as dicas do tutorial abaixo e remova todos os problemas que ele encontrar:

Tutorial do Malwarebytes Anti-Malware
___________________________

:veja: Na sua pr&oacute;xima resposta poste o novo log do Malwarebytes juntamente com um novo log do Hijackthis e nos diga como est&aacute; o seu PC ap&oacute;s este procedimento. 

Ficamos no aguardo.

Answer

Vou ler e j&aacute; posto os logs.

Answer

[quote=toror&oacute;, post: 5049989]Vou ler e j&aacute; posto os logs.[/QUOTE]
:) Ok, ficamos no aguardo

Answer

Pronto!
Passei o Malwarebytes e deletei todas as amea&ccedil;as...
e passei de novo como pedido, segue o log:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4366

Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

30/7/2010 16:54:19
mbam-log-2010-07-30 (16-54-19).txt

Scan type: Full scan (C:\|)
Objects scanned: 206218
Time elapsed: 29 minute(s), 55 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

passei o Hijack:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:55:13, on 30/7/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Arquivos de programas\Mozilla Firefox\firefox.exe
C:\Arquivos de programas\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Luiz\Desktop\HiJackThis.exe
C:\Arquivos de programas\Skype\Toolbars\Shared\SkypeNames2.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Arquivos de programas\Winamp Toolbar\winamptb.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Arquivos de programas\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Programa Auxiliar de In&iacute;cio de Sess&atilde;o do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {990F4E75-0E04-470E-ADB0-C6B69A9ABDF6} - c:\windows\system32\pwptpsp.dll (file missing)
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\Arquivos de programas\GbPlugin\gbieh.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Arquivos de programas\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Arquivos de programas\Winamp Toolbar\winamptb.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Arquivos de programas\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Arquivos de programas\BitDefender\BitDefender 2010\IEToolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [TdspMaLoader] C:\Arquivos de programas\3DSP\Total Wireless\panel\TdspMaLoader.exe
O4 - HKLM\..\Run: [Control Center] C:\Arquivos de programas\Control Center\CCenter.exe
O4 - HKLM\..\Run: [GrooveMonitor] C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Arquivos de programas\Java\jre6\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [BDWizReg] C:\Arquivos de programas\BitDefender\BitDefender 2010\bdwizreg.exe /complete
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] C:\Arquivos de programas\BitDefender\BitDefender 2010\IEShow.exe
O4 - HKLM\..\Run: [BDAgent] C:\Arquivos de programas\BitDefender\BitDefender 2010\bdagent.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [avgnt] C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe /min
O4 - HKLM\..\RunOnce: [ GbPluginBb] RunDll32.exe C:\ARQUIV~1\GbPlugin\gbieh.dll,Gbieh
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe
O4 - HKCU\..\Run: [EPSON Stylus Office T33 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEEB.EXE /FU C:\WINDOWS\TEMP\E_S855.tmp /EF HKCU
O4 - HKCU\..\Run: [DAEMON Tools Lite] C:\Arquivos de programas\DAEMON Tools Lite\daemon.exe -autorun
O4 - HKCU\..\Run: [msnmsgr] C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe /background
O4 - HKCU\..\Run: [siede] C:\Documents and Settings\Luiz\siede.exe
O4 - HKCU\..\Run: [yaomiq] C:\Documents and Settings\Luiz\yaomiq.exe
O4 - HKCU\..\Run: [heaasul] C:\Documents and Settings\Luiz\heaasul.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1150600.exe -Update -1150600 -Mozilla/5.0_(Windows;_U;_Windows_NT_5.1;_pt-BR;_rv:1.9.0.15)_Gecko/2009101601_Firefox/3.0.15_(.NET_CLR_3.5.30729) -http://meusjogosdemeninas.uol.com.br/jogos/jogos-de-desenhos-animados/a-luta-das-almofadas.jsp
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Recorte de tela e Iniciador do OneNote 2007.lnk = C:\Arquivos de programas\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dados de aplicativos\Winamp Toolbar\ieToolbaresources\en-US\local\search.html
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Publicar em Blogue - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Arquivos de programas\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Publicar no Blogue no Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Arquivos de programas\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O15 - Trusted Zone: http://www.bancobrasil.com.br
O15 - Trusted Zone: http://www.bb.com.br
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Arquivos de programas\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1264526067687
O16 - DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} (GbpDistObj Class) - https://www14.bancobrasil.com.br/plugin/GbpDist.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify:  GbPluginBb - C:\Arquivos de programas\GbPlugin\gbieh.dll
O20 - Winlogon Notify: cryptnet32 - cryptnet32.dll (file missing)
O22 - SharedTaskScheduler: Pr&eacute;-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon de cache de categorias de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Programador (AntiVirSchedulerService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira Upgrade Service (AntiVirUpgradeService) - Unknown owner - C:\DOCUME~1\Luiz\CONFIG~1\Temp\AVSETUP_4c50ea99\basic\avupgsvc.exe (file missing)
O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Arquivos de programas\Arquivos comuns\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Arquivos de programas\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Gbp Service (GbpSv) -   - C:\ARQUIV~1\GbPlugin\GbpSv.exe
O23 - Service: Google Update Service (gupdate1ca51f6cef3e318) (gupdate1ca51f6cef3e318) - Google Inc. - C:\Arquivos de programas\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender S.R.L. - C:\Arquivos de programas\Arquivos comuns\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Arquivos de programas\Eset
od32krn.exe
O23 - Service: Start BT in service - Unknown owner - C:\Arquivos de programas\IVT Corporation\BlueSoleil\StartSkysolSvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Arquivos de programas\BitDefender\BitDefender 2010\vsserv.exe

--
End of file - 12093 bytes

O sistema ainda n&atilde;o melhorou, ap&oacute;s a exclus&atilde;o eu reiniciei o pc no modo normal, mas ele reiniciou novamente... aparecendo a tela azul =/

Answer

ah, o aviso Generic Host Process for Win32 Services
ainda continua aparecendo.
um outro aviso tamb&eacute;m apareceu:

Answer

* fa&ccedil;a o download do ComboFix., salve-o no desktop:
http://download.bleepingcomputer.com/protected/4538afb54478c6c8eaab60645075f1e1/4c45a198/ComboFix.exe
ou
http://rapidshare.com/files/407986559/ComboFix.exe
	
* Desative temporariamente o seu Antivirus.
* Execute-o - Aceite o contrato.

* Caso o console de recupera&ccedil;&atilde;o j&aacute; esteja instalado o ComboFix ir&aacute; continuar o processo 	automaticamente.
* Caso n&atilde;o esteja, uma janela, ser&aacute; exibida solicitando a instala&ccedil;&atilde;o. Clique em [SIM] para aceit&aacute;-la.

Importante: enquanto o ComboFix estiver em execu&ccedil;&atilde;o, n&atilde;o use o mouse nem o teclado!!.
&ndash; O programa ser&aacute; fechado automaticamente. --

* envie o relat&oacute;rio criado em C:\combofix.txt e um novo Log do hijackthis.

Answer

valeu, j&aacute; to baixando...

Answer

po, no desespero eu baixei mais dois anti-virus, o avira e o bitdefender...
n&atilde;o sei como desativ&aacute;-los...

Answer

* Desinstale-os via Painel de controle->adicionar & Remover Programas ou utilize o Revo Uninstaller: http://www.baixaki.com.br/download/revo-uninstaller.htm

Answer

mesmo no modo de seguran&ccedil;a o Revo uninstaller consegue desinstalar completamente o programa?

Answer

Cosegui desinstalar o nod e o avira, mas o bitdefender n&atilde;o.
Pelo Revo, consegui praticamente desistal&aacute;-lo, eliminando todos os arquivos dele, mas consta que n&atilde;o foi desinstalado no combofix.
Posso prosseguir?

Answer

* sim! pode prosseguir...

Answer

log do combofix:

ComboFix 10-07-30.01 - Luiz 30/07/2010  22:25:49.1.2 - x86 NETWORK
Microsoft Windows XP Professional  5.1.2600.3.1252.55.1046.18.2909.2638 [GMT -4:00]
Executando de: c:\documents and settings\Luiz\Desktop\ComboFix.exe
AV: BitDefender Antivirus *On-access scanning enabled* (Outdated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
FW: BitDefender Firewall *enabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
.
 ADS - drivers: deleted 204 bytes in 1 streams.

(((((((((((((((((((((((((((((((((((((   Outras Exclus&otilde;es   )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Luiz\autorun.inf
c:\documents and settings\Luiz\Configura&ccedil;&otilde;es locais\Dados de aplicativos\Google\Update\GoogleUpdateBeta.exe
c:\documents and settings\Luiz\Cookies.lnk
c:\documents and settings\Luiz\ert.dll
c:\documents and settings\Luiz\heaasul.exe
c:\documents and settings\Luiz\heaasulx.exe
c:\documents and settings\Luiz\jiakul.exe
c:\documents and settings\Luizueln.exe
c:\documents and settings\Luiz\youboy.exe
c:\windows\system32\AutoRun.inf
c:\windows\system32\config\systemprofile	auzax.exe
c:\windows\system32\drivers\bxhjexmw.sys
c:\windows\system32\drivers\qkpwvsuw.sys
c:\windows\system32\kwphvag.dll
c:\windows\system32\pwptpsp.dll
c:\windows\system32\vbzlib1.dll

A c&oacute;pia de c:\windows\system32\drivers
etbt.sys foi encontrada e desinfectada 
C&oacute;pia restaurada de - Kitty had a snack :p 
.
(((((((((((((((((((((((((((((((((((((((   Drivers/Servi&ccedil;os   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_GOOGLEUPDATEBETA
-------\Legacy_QKPWVSUW
-------\Legacy_SSHNAS
-------\Legacy_XGAPLJCG
-------\Service_qkpwvsuw
-------\Service_xgapljcg

((((((((((((((((   Arquivos/Ficheiros criados de 2010-06-28 to 2010-07-31  ))))))))))))))))))))))))))))
.

2010-07-31 01:41 . 2010-07-31 01:41    --------    d-----w-    c:\arquivos de programas\VS Revo Group
2010-07-29 16:09 . 2010-07-29 16:09    --------    d-----w-    c:\documents and settings\Luiz\Dados de aplicativos\Malwarebytes
2010-07-29 16:09 . 2010-04-29 19:39    38224    ----a-w-    c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-29 16:09 . 2010-07-29 16:09    --------    d-----w-    c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes
2010-07-29 16:09 . 2010-07-29 17:29    --------    d-----w-    c:\arquivos de programas\Malwarebytes' Anti-Malware
2010-07-29 16:09 . 2010-04-29 19:39    20952    ----a-w-    c:\windows\system32\drivers\mbam.sys
2010-07-29 02:55 . 2009-11-25 16:19    56816    ----a-w-    c:\windows\system32\drivers\avgntflt.sys
2010-07-29 00:53 . 2010-07-29 00:54    --------    d-----w-    c:\windows\LastGood
2010-07-29 00:53 . 2010-07-31 01:49    --------    d-----w-    c:\documents and settings\All Users\Dados de aplicativos\Avira
2010-07-28 18:21 . 2010-07-28 18:21    --------    d-----w-    c:\windows\LastGood.Tmp
2010-07-28 18:21 . 2010-07-28 18:21    --------    d-----w-    c:\documents and settings\Luiz\Dados de aplicativos\BitDefender
2010-07-28 18:20 . 2010-07-28 18:30    --------    d-----w-    c:\documents and settings\All Users\Dados de aplicativos\BitDefender
2010-07-28 18:18 . 2010-07-28 18:18    --------    d-----w-    c:\windows\system32\URTTEMP
2010-07-28 18:17 . 2010-07-28 18:20    --------    d-----w-    c:\arquivos de programas\Arquivos comuns\BitDefender
2010-07-28 16:22 . 2010-07-28 16:22    --------    d-----w-    c:\documents and settings\Luiz\Dados de aplicativos\DAEMON Tools Pro
2010-07-27 16:29 . 2010-07-27 16:34    --------    d-----w-    C:\MSNCleaner
2010-07-27 16:05 . 2010-07-27 16:05    --------    d-----w-    c:\arquivos de programas\AxBx
2010-07-27 03:42 . 2010-07-27 03:42    --------    d-sh--w-    c:\documents and settings\NetworkService\IETldCache
2010-07-27 01:22 . 2010-07-27 01:22    --------    d-----r-    c:\documents and settings\NetworkService\Favoritos
2010-07-26 20:12 . 2010-07-26 20:12    --------    d-----w-    c:\documents and settings\All Users\Dados de aplicativos\Bluetooth
2010-07-01 19:34 . 2010-07-01 19:49    205824    ----a-w-    c:\windows\system32\cftu.exe

.
(((((((((((((((((((((((((((((((((((((   Relat&oacute;rio Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-31 01:57 . 2009-06-29 01:32    --------    d-----w-    c:\arquivos de programas\ESET
2010-07-28 21:25 . 2009-06-29 01:37    --------    d-----w-    c:\documents and settings\Luiz\Dados de aplicativos\Ahead
2010-07-28 18:19 . 2008-04-14 12:00    83670    ----a-w-    c:\windows\system32\perfc016.dat
2010-07-28 18:19 . 2008-04-14 12:00    479350    ----a-w-    c:\windows\system32\perfh016.dat
2010-07-27 18:22 . 2010-01-26 02:57    --------    d-----w-    c:\documents and settings\Luiz\Dados de aplicativos\BitComet
2010-07-26 23:53 . 2010-05-11 01:13    --------    d-----w-    c:\documents and settings\Luiz\Dados de aplicativos\Skype
2010-07-17 21:53 . 2009-06-29 01:25    --------    d-----w-    c:\documents and settings\All Users\Dados de aplicativos\Microsoft Help
2010-06-30 18:57 . 2010-06-30 18:48    --------    d-----w-    c:\documents and settings\Luiz\Dados de aplicativos\U3
2010-06-14 14:31 . 2009-06-29 01:55    744448    ----a-w-    c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-13 21:33 . 2009-07-12 16:08    --------    d-----w-    c:\documents and settings\Luiz\Dados de aplicativos\Winamp
2010-06-09 11:00 . 2009-11-01 00:01    --------    d-----w-    c:\documents and settings\All Users\Dados de aplicativos\GbPlugin
2010-06-09 11:00 . 2009-11-01 00:01    --------    d-----w-    c:\arquivos de programas\GbPlugin
2010-06-04 16:15 . 2009-12-08 01:23    --------    d-----w-    c:\arquivos de programas\BrT 3G Modem
2010-06-04 16:13 . 2010-05-11 01:17    --------    d-----w-    c:\documents and settings\Luiz\Dados de aplicativos\skypePM
2010-06-04 16:12 . 2009-11-26 20:30    --------    d-----w-    c:\arquivos de programas\Microsoft Silverlight
2010-05-29 20:58 . 2010-05-29 20:58    503808    ----a-w-    c:\documents and settings\Luiz\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\46\f84c6ae-2b0b45a2-n\msvcp71.dll
2010-05-29 20:58 . 2010-05-29 20:58    499712    ----a-w-    c:\documents and settings\Luiz\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\46\f84c6ae-2b0b45a2-n\jmc.dll
2010-05-29 20:58 . 2010-05-29 20:58    348160    ----a-w-    c:\documents and settings\Luiz\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\46\f84c6ae-2b0b45a2-n\msvcr71.dll
2010-05-26 14:48 . 2009-11-01 00:01    45472    ----a-w-    c:\windows\system32\drivers\gbpkm.sys
2010-05-11 01:17 . 2010-05-11 01:17    56    ---ha-w-    c:\windows\system32\ezsidmv.dat
2010-05-06 10:34 . 2008-04-14 12:00    916480    ----a-w-    c:\windows\system32\wininet.dll
2010-05-02 08:08 . 2008-04-14 12:00    1851392    ----a-w-    c:\windows\system32\win32k.sys
.

((((((((((((((((((((((((((   Pontos de Carregamento do Registro   )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e leg&iacute;timas por defeito n&atilde;o s&atilde;o mostradas. 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}=c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe [2007-06-27 152872]
DAEMON Tools Lite=c:\arquivos de programas\DAEMON Tools Lite\daemon.exe [2009-04-23 691656]
msnmsgr=c:\arquivos de programas\Windows Live\Messenger\msnmsgr.exe [2009-07-26 3883856]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
Shockwave Updater=c:\windows\system32\Adobe\Shockwave 11\SwHelper_1150600.exe [2009-06-05 468408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
IgfxTray=c:\windows\system32\igfxtray.exe [2008-08-11 150040]
HotKeysCmds=c:\windows\system32\hkcmd.exe [2008-08-11 170520]
Persistence=c:\windows\system32\igfxpers.exe [2008-08-11 141848]
RTHDCPL=RTHDCPL.EXE [2008-05-07 16862208]
TdspMaLoader=c:\arquivos de programas\3DSP\Total Wireless\panel\TdspMaLoader.exe [2008-08-04 20480]
Control Center=c:\arquivos de programas\Control Center\CCenter.exe [2008-12-23 793600]
GrooveMonitor=c:\arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
SunJavaUpdateSched=c:\arquivos de programas\Java\jre6\bin\jusched.exe [2009-10-31 149280]
NeroFilterCheck=c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe [2007-03-01 153136]
Adobe Reader Speed Launcher=c:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
GbPluginBb=c:\arquiv~1\GbPlugin\gbieh.dll [2010-05-26 335136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
CTFMON.EXE=c:\windows\system32\CTFMON.EXE [2008-04-14 15360]

c:\documents and settings\Luiz\Menu Iniciar\Programas\Inicializar\
Recorte de tela e Iniciador do OneNote 2007.lnk - c:\arquivos de programas\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\ GbPluginBb]
2010-05-26 14:47    335136    ----a-w-    c:\arquivos de programas\GbPlugin\gbieh.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^KYESCAN.lnk]
path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\KYESCAN.lnk
backup=c:\windows\pss\KYESCAN.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 20:44    3883856    ----a-w-    c:\arquivos de programas\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2010-01-13 22:44    37888    ----a-w-    c:\arquivos de programas\Winamp\winampa.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
%windir%\Network Diagnostic\xpnetdiag.exe=
%windir%\system32\sessmgr.exe=
c:\Arquivos de programas\Microsoft Office\Office12\OUTLOOK.EXE=
c:\Arquivos de programas\Microsoft Office\Office12\GROOVE.EXE=
c:\Arquivos de programas\Microsoft Office\Office12\ONENOTE.EXE=
c:\Arquivos de programas\Messenger\msmsgs.exe=
c:\Arquivos de programas\Windows Live\Sync\WindowsLiveSync.exe=
c:\Arquivos de programas\BitComet\BitComet.exe=
c:\Arquivos de programas\Skype\Plugin Manager\skypePM.exe=
c:\Arquivos de programas\Skype\Phone\Skype.exe=
c:\Arquivos de programas\Windows Live\Messenger\wlcsdk.exe=
c:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe=
c:\Arquivos de programas\IVT Corporation\BlueSoleil\BlueSoleil.exe=
c:\WINDOWS\system32\ftp.exe=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
13468:TCP= 13468:TCP:BitComet 13468 TCP
13468:UDP= 13468:UDP:BitComet 13468 UDP

R0 GbpKm;Gbp KernelMode;c:\windows\system32\drivers\gbpkm.sys [31/10/2009 20:01 45472]
R0 tpsacpi;TPS Firmware Extension Device Driver;c:\windows\system32\drivers	psacpi.sys [28/6/2009 22:15 10728]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [6/8/2009 16:34 110728]
R3 MFCARD;3DSP WLAN and BlueTooth Card;c:\windows\system32\drivers	dspbus.sys [28/6/2009 22:14 4243072]
S2 AntiVirUpgradeService;Avira Upgrade Service;c:\docume~1\Luiz\CONFIG~1\Temp\AVSETUP_4c50ea99\basic\avupgsvc.exe /TEMPSTART:c:\docume~1\Luiz\CONFIG~1\Temp\AVSETUP_4c50ea99\basic\setup.exe /NOTEMPCLEANUP /CROSSUPGRADE --> c:\docume~1\Luiz\CONFIG~1\Temp\AVSETUP_4c50ea99\basic\avupgsvc.exe [?]
S2 BDVEDISK;BDVEDISK;\??\c:\arquivos de programas\BitDefender\BitDefender 2010\bdvedisk.sys --> c:\arquivos de programas\BitDefender\BitDefender 2010\bdvedisk.sys [?]
S2 BulkUsb;Genius ColorPage USB Scanner;c:\windows\system32\drivers\usbscan.sys [25/4/2010 20:51 15104]
S2 GbpSv;Gbp Service;c:\arquiv~1\GbPlugin\GbpSv.exe [31/10/2009 20:01 55072]
S2 gupdate1ca51f6cef3e318;Google Update Service (gupdate1ca51f6cef3e318);c:\arquivos de programas\Google\Update\GoogleUpdate.exe [20/10/2009 22:33 133104]
S2 Start BT in service;Start BT in service;c:\arquivos de programas\IVT Corporation\BlueSoleil\StartSkysolSvc.exe [27/12/2007 15:39 51816]
S3 Arrakis3;BitDefender Arrakis Server;c:\arquivos de programas\Arquivos comuns\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe [25/6/2009 16:04 176128]
S3 AVEOFilterDriver;AVEO Camera filter driver;c:\windows\system32\drivers\aveofilter.sys [28/6/2009 22:09 120704]
S3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [29/6/2009 14:12 152328]
S3 BTCARD;3DSP Bluetooth Card v2.0;c:\windows\system32\drivers\btcard.sys [28/6/2009 22:14 214656]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\drivers\ewusbdev.sys [30/4/2010 09:24 100480]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [28/6/2009 22:03 110080]
S3 WLAN3DSPXP;3DSP WLAN Card;c:\windows\system32\drivers\wltbus50.sys [28/6/2009 22:14 165376]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [7/8/2009 13:24 721904]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx    REG_MULTI_SZ       scan
.
Conte&uacute;do da pasta 'Tarefas Agendadas'

2010-07-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\arquivos de programas\Google\Update\GoogleUpdate.exe [2009-10-21 02:32]

2010-07-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\arquivos de programas\Google\Update\GoogleUpdate.exe [2009-10-21 02:32]

2010-04-18 c:\windows\Tasks\Install.job
- c:\windows\system32\Macromed\Shockwave 10
ssstub.exe [2010-04-17 20:48]

2010-07-31 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 19:07]
.
.
------- Scan Suplementar -------
.
uInternet Connection Wizard,ShellNext = iexplore
IE: &Winamp Search - c:\documents and settings\All Users\Dados de aplicativos\Winamp Toolbar\ieToolbaresources\en-US\local\search.html
IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: bancobrasil.com.br\www
Trusted Zone: bancobrasil.com.br\www14
Trusted Zone: bancobrasil.com.br\www2
Trusted Zone: bb.com.br\www
DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} - hxxps://www14.bancobrasil.com.br/plugin/GbpDist.cab
FF - ProfilePath - c:\documents and settings\Luiz\Dados de aplicativos\Mozilla\Firefox\Profiles\wv5h0z9p.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.ambientebrasil.com.br/
FF - component: c:\arquivos de programas\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\arquivos de programas\Google\Google Earth\plugin
pgeplugin.dll
FF - plugin: c:\arquivos de programas\Google\Update\1.2.183.23
pGoogleOneClick8.dll
FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins
ppl3260.dll
FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins
prpjplug.dll
FF - plugin: c:\arquivos de programas\Microsoft\Office Live
pOLW.dll
FF - plugin: c:\arquivos de programas\Mozilla Firefox\plugins
pwachk.dll
FF - plugin: c:\arquivos de programas\Mozilla Firefox\plugins
pyaxmpb.dll
FF - plugin: c:\arquivos de programas\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref(browser.fixup.alternate.suffix, .com.br);
.
- - - - ORF&Atilde;OS REMOVIDOS - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-siede - c:\documents and settings\Luiz\siede.exe
HKCU-Run-yaomiq - c:\documents and settings\Luiz\yaomiq.exe
HKCU-Run-heaasul - c:\documents and settings\Luiz\heaasul.exe
HKLM-Run-BDWizReg - c:\arquivos de programas\BitDefender\BitDefender 2010\bdwizreg.exe
HKLM-Run-BitDefender Antiphishing Helper - c:\arquivos de programas\BitDefender\BitDefender 2010\IEShow.exe
HKLM-Run-BDAgent - c:\arquivos de programas\BitDefender\BitDefender 2010\bdagent.exe
MSConfigStartUp-nod32kui - c:\arquivos de programas\Eset
od32kui.exe
AddRemove-DAEMON Tools Toolbar - c:\arquivos de programas\DAEMON Tools Toolbar\uninst.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-30 22:36
Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializ&aacute;veis ocultas ...

Procurando ficheiros/arquivos ocultos ...

c:\windows\system32\drivers\zmyxdysb3.sys 82944 bytes executable

Varredura completada com sucesso
arquivos/ficheiros ocultos: 1

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\zmyxdysb3]
ImagePath=system32\drivers\zmyxdysb3.sys
.
--------------------- DLLs Carregadas Sob os Processos em Execu&ccedil;&atilde;o ---------------------

- - - - - - - > 'winlogon.exe'(1044)
c:\arquivos de programas\GbPlugin\gbieh.dll
.
Tempo para conclus&atilde;o: 2010-07-30  22:39:40 - M&aacute;quina reiniciou
ComboFix-quarantined-files.txt  2010-07-31 02:39

Pr&eacute;-execu&ccedil;&atilde;o: 8 pasta(s) 236.680.384.512 bytes dispon&iacute;veis
P&oacute;s execu&ccedil;&atilde;o: 12 pasta(s) 246.193.844.224 bytes dispon&iacute;veis

WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT=Microsoft Windows Recovery Console /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=Microsoft Windows XP Professional /fastdetect /NoExecute=OptIn

- - End Of File - - 495B8FCE472EDBA02D080CDDDA302C29

log do hijackthis

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:43:06, on 30/7/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32
otepad.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Luiz\Desktop\HiJackThis.exe
C:\Arquivos de programas\Mozilla Firefox\firefox.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Arquivos de programas\Winamp Toolbar\winamptb.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Arquivos de programas\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Programa Auxiliar de In&iacute;cio de Sess&atilde;o do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\Arquivos de programas\GbPlugin\gbieh.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Arquivos de programas\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Arquivos de programas\Winamp Toolbar\winamptb.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Arquivos de programas\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Arquivos de programas\BitDefender\BitDefender 2010\IEToolbar.dll (file missing)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [TdspMaLoader] C:\Arquivos de programas\3DSP\Total Wireless\panel\TdspMaLoader.exe
O4 - HKLM\..\Run: [Control Center] C:\Arquivos de programas\Control Center\CCenter.exe
O4 - HKLM\..\Run: [GrooveMonitor] C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Arquivos de programas\Java\jre6\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe
O4 - HKLM\..\RunOnce: [ GbPluginBb] RunDll32.exe C:\ARQUIV~1\GbPlugin\gbieh.dll,Gbieh
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] C:\Arquivos de programas\DAEMON Tools Lite\daemon.exe -autorun
O4 - HKCU\..\Run: [msnmsgr] C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe /background
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1150600.exe -Update -1150600 -Mozilla/5.0_(Windows;_U;_Windows_NT_5.1;_pt-BR;_rv:1.9.0.15)_Gecko/2009101601_Firefox/3.0.15_(.NET_CLR_3.5.30729) -http://meusjogosdemeninas.uol.com.br/jogos/jogos-de-desenhos-animados/a-luta-das-almofadas.jsp
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Recorte de tela e Iniciador do OneNote 2007.lnk = C:\Arquivos de programas\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dados de aplicativos\Winamp Toolbar\ieToolbaresources\en-US\local\search.html
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Publicar em Blogue - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Arquivos de programas\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Publicar no Blogue no Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Arquivos de programas\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O15 - Trusted Zone: http://www.bancobrasil.com.br
O15 - Trusted Zone: http://www.bb.com.br
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Arquivos de programas\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1264526067687
O16 - DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} (GbpDistObj Class) - https://www14.bancobrasil.com.br/plugin/GbpDist.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify:  GbPluginBb - C:\Arquivos de programas\GbPlugin\gbieh.dll
O22 - SharedTaskScheduler: Pr&eacute;-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon de cache de categorias de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira Upgrade Service (AntiVirUpgradeService) - Unknown owner - C:\DOCUME~1\Luiz\CONFIG~1\Temp\AVSETUP_4c50ea99\basic\avupgsvc.exe (file missing)
O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Arquivos de programas\Arquivos comuns\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Arquivos de programas\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Gbp Service (GbpSv) -   - C:\ARQUIV~1\GbPlugin\GbpSv.exe
O23 - Service: Google Update Service (gupdate1ca51f6cef3e318) (gupdate1ca51f6cef3e318) - Google Inc. - C:\Arquivos de programas\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender S.R.L. - C:\Arquivos de programas\Arquivos comuns\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe
O23 - Service: Start BT in service - Unknown owner - C:\Arquivos de programas\IVT Corporation\BlueSoleil\StartSkysolSvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Arquivos de programas\BitDefender\BitDefender 2010\vsserv.exe (file missing)

--
End of file - 9937 bytes

Answer

:) Outros problemas foram removidos pelo Combofix.

:veja: Siga, por gentileza, as dicas destes tutoriais:
	
[color=#0000FF]Tutorial do USBFix[/color]

[COLOR=Blue]Tutorial do Norman Malware Cleaner[/COLOR]

[COLOR=Blue]Tutorial do antivirus Nod32 Online[/COLOR]
_________________________

:veja: Poste o log do Usbfix que estar&aacute; em C:\UsbFix.txt em sua pr&oacute;xima resposta juntamente com um novo log do Hijackthis, o log do Norman Malware Cleaner e o log que estar&aacute; em C:\Arquivos de programas\Eset\Eset Online Scanner\log.txt e nos diga como est&aacute; o PC ap&oacute;s estes procedimentos.

Ficamos no aguardo.

Ferramentas

Mover Tópico