Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:23:25, on 26/05/08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\windir32.exe
C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe
C:\ARQUIV~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\svchost.exe
C:\ARQUIV~1\AVG\AVG8\avgrsx.exe
C:\ARQUIV~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe
C:\Arquivos de programas\Windows Live\Messenger\usnsvc.exe
C:\Arquivos de programas\Mozilla Firefox\firefox.exe
C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.MSN.com.br/0SEPTBR/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Arquivos de programas\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {588489FB-7FC8-4F95-A993-33B69F8C66EA} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ActivationManager module - {86A44EF7-78FC-4e18-A564-B18F806F7F56} - C:\Arquivos de programas\ActivationManager\ActivationManager.dll (file missing)
O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {FD03C949-1F23-41EA-B53A-C31EE0154454} - C:\WINDOWS\system32\iifcdcb.dll (file missing)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [wscntfy] C:\WINDOWS\system\wscntfy.exe
O4 - HKLM\..\Run: [Media Codec Update Service] C:\Arquivos de programas\Essentials Codec Pack\update.exe -silent
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [windir32] C:\WINDOWS\system32\windir32.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARQUIV~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\RunServices: [windir32] C:\WINDOWS\system32\windir32.exe
O4 - HKLM\..\RunOnce: [Explorer] C:\WINDOWS\system\ctfmon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [windir32] C:\WINDOWS\system32\windir32.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: BrOffice.org 2.3.lnk = C:\Arquivos de programas\BrOffice.org 2.3\program\quickstart.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Arquivos de programas\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Arquivos de programas\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O17 - HKLM\System\CCS\Services\Tcpip\..\{68349F0F-15BB-4692-A3C9-EEB94F7AE479}: NameServer = 200.204.0.10,200.204.0.138
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Arquivos de programas\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: bbrdehed - bbrdehed.dll (file missing)
O20 - Winlogon Notify: iifcdcb - iifcdcb.dll (file missing)
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

--
End of file - 6432 bytes

Baixe o ComboFix e salve no desktop.

Nota: Por favor, NÃO utilize o ComboFix sozinho. É uma ferramenta poderosa criada pra lidar com infeções sofisticadas e caso não a utilize corretamente poderá danificar o seu computador. A ferramenta apenas deve ser utilizada sob supervisão de Assistentes de remoção de malware.

Feche todas as janelas e programas.
Dê um duplo-clique no combofix.exe e tecle "1" em seguida Enter para prosseguir o Fix. Vai durar uma média de 10 minutos.
O ComboFix reiniciará o PC automaticamente para completar o processo de remoção.

Quando acabar, será gerado um log, que vai estar em C:\ComboFix.txt.

Atenção:
Não clique na Janela do ComboFix, nem o feche clicando no X, enquanto estiver rodando, pois senão irá parar e seu desktop ficará em branco.

Para parar ou sair do ComboFix, tecle "2" e Enter.

Depois gere um novo log com o HijackThis e poste, juntamente com o ComboFix.txt.

Log feito apos o combofix

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:48:13, on 28/05/08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\mnmsrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\ARQUIV~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\ARQUIV~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\BrOffice.org 2.3\program\soffice.exe
C:\Arquivos de programas\BrOffice.org 2.3\program\soffice.BIN
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Arquivos de programas\AVG\AVG8\avgrsx.exe
C:\Arquivos de programas\Mozilla Firefox\firefox.exe
C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Arquivos de programas\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [wscntfy] C:\WINDOWS\system\wscntfy.exe
O4 - HKLM\..\Run: [Media Codec Update Service] C:\Arquivos de programas\Essentials Codec Pack\update.exe -silent
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [windir32] C:\WINDOWS\system32\windir32.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARQUIV~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\RunServices: [windir32] C:\WINDOWS\system32\windir32.exe
O4 - HKLM\..\RunOnce: [Explorer] C:\WINDOWS\system\ctfmon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [windir32] C:\WINDOWS\system32\windir32.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: BrOffice.org 2.3.lnk = C:\Arquivos de programas\BrOffice.org 2.3\program\quickstart.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Arquivos de programas\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Arquivos de programas\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O17 - HKLM\System\CCS\Services\Tcpip\..\{68349F0F-15BB-4692-A3C9-EEB94F7AE479}: NameServer = 200.204.0.10,200.204.0.138
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Arquivos de programas\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: bbrdehed - bbrdehed.dll (file missing)
O20 - Winlogon Notify: iifcdcb - iifcdcb.dll (file missing)
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

--
End of file - 5965 bytes


log do combofix

ComboFix 08-05-27.4 - Luciano 2008-05-28 12:14:28.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.233 [GMT -3:00]
Executando de: C:\Documents and Settings\Luciano\Desktop\ComboFix.exe
* Criado um novo ponto de restauro

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((( Outras Exclusäes )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system\alg.exe
C:\WINDOWS\system32\bbrdehed.dllbox
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\sstwa.ini
C:\WINDOWS\system32\sstwa.ini2
C:\WINDOWS\system32\WMM2RE4.dll

.
((((((((((((((((((((((( Ficheiros criados de 2008-04-28 to 2008-05-28 ))))))))))))))))))))))))))))))))
.

2008-05-26 15:20 . 2008-05-26 15:20 <DIR> d-------- C:\Arquivos de programas\Trend Micro
2008-05-25 13:48 . 2008-05-28 11:55 <DIR> d--h----- C:\$AVG8.VAULT$
2008-05-25 13:34 . 2008-05-25 13:23 691,545 --a------ C:\WINDOWS\unins000.exe
2008-05-25 13:34 . 2008-05-25 13:34 2,555 --a------ C:\WINDOWS\unins000.dat
2008-05-25 13:32 . 2008-05-27 18:06 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-05-25 13:32 . 2008-05-25 13:32 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\avg8
2008-05-25 13:32 . 2008-05-25 13:32 <DIR> d-------- C:\Arquivos de programas\AVG
2008-05-25 13:32 . 2008-05-25 13:32 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-05-25 13:32 . 2008-05-25 13:32 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-05-25 13:32 . 2008-05-25 13:32 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-05-25 09:57 . 2008-05-21 15:06 754,176 --a------ C:\WINDOWS\system32\8204747.INS
2008-05-24 22:50 . 2008-05-21 15:06 754,176 --a------ C:\WINDOWS\system32\37224256.INS
2008-05-24 18:47 . 2008-05-21 15:06 754,176 --a------ C:\WINDOWS\system32\31861617.INS
2008-05-24 10:13 . 2008-05-24 10:13 <DIR> d-------- C:\WINDOWS\system32\sounds
2008-05-24 10:13 . 2008-05-24 10:13 <DIR> d-------- C:\WINDOWS\system32\logs
2008-05-24 10:13 . 2008-05-21 15:06 754,176 --a------ C:\WINDOWS\system32\windir32.exe
2008-05-24 10:13 . 2008-05-21 23:54 704,866 --a------ C:\WINDOWS\system32\windir32.zip
2008-05-24 10:13 . 2008-02-11 06:07 118,784 --a------ C:\WINDOWS\system32\secus16.exe
2008-05-24 10:13 . 2008-05-15 14:57 26,585 --a------ C:\WINDOWS\system32\WMM2RE3.dll
2008-05-24 10:13 . 2008-05-18 07:35 20,064 --a------ C:\WINDOWS\system32\WMM2RE2.dll
2008-05-24 10:13 . 2008-05-24 14:45 16,381 --a------ C:\WINDOWS\system32\gm2re1.pif
2008-05-24 10:13 . 2008-05-28 12:26 4,734 --a------ C:\WINDOWS\system32\mirc.ini
2008-05-24 10:12 . 2008-05-25 09:57 1,821,030 --a------ C:\tot.exe
2008-05-14 00:36 . 2008-05-14 00:36 <DIR> d-------- C:\Documents and Settings\Luciano\Dados de aplicativos\pdf995
2008-05-14 00:36 . 2008-05-14 00:36 28 --a------ C:\WINDOWS\pdf995.ini

.
((((((((((((((((((((((((((((((((((((( Relat¢rio Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-28 15:26 --------- d-----w C:\Documents and Settings\Luciano\Dados de aplicativos\BrOffice.org2
2008-05-28 01:23 --------- d-----w C:\Arquivos de programas\microsoft frontpage
2008-05-27 00:34 --------- d-----w C:\Arquivos de programas\Zuma Deluxe
2008-05-27 00:33 --------- d-----w C:\Arquivos de programas\Acro Software
2008-05-25 16:48 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy
2008-05-25 16:46 --------- d-----w C:\Arquivos de programas\Spybot - Search & Destroy
2008-05-25 03:46 --------- d-----w C:\Arquivos de programas\Windows Live Safety Center
2008-05-14 03:37 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\pdf995
2008-05-14 02:08 --------- d-----w C:\Arquivos de programas\Lexmark X1100 Series
2008-04-20 18:23 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft Help
2008-04-19 13:22 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Adobe
2008-04-15 02:54 --------- d-----w C:\Arquivos de programas\pdf995
2008-04-11 21:34 --------- d-----w C:\Documents and Settings\Luciano\Dados de aplicativos\Dev-Cpp
2008-04-04 22:25 --------- d-----w C:\Arquivos de programas\7-Zip
2008-03-29 14:41 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\WinZip
2008-03-29 14:38 --------- d-----w C:\Arquivos de programas\PicPerk
2008-03-29 14:19 --------- d-----w C:\Arquivos de programas\eMule
2008-03-28 14:59 --------- d-----w C:\Arquivos de programas\Programas RFB
2008-01-03 01:44 774,144 ----a-w C:\Arquivos de programas\RngInterstitial.dll
.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* entradas vazias & leg¡timas por defeito nÆo sÆo mostradas.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{588489FB-7FC8-4F95-A993-33B69F8C66EA}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{86A44EF7-78FC-4e18-A564-B18F806F7F56}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD03C949-1F23-41EA-B53A-C31EE0154454}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:45 15360]
"MSMSGS"="C:\Arquivos de programas\Messenger\msmsgs.exe" [ ]
"windir32"="C:\WINDOWS\system32\windir32.exe" [2008-05-21 15:06 754176]
"SpybotSD TeaTimer"="C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2003-02-27 14:29 47104 C:\WINDOWS\SOUNDMAN.EXE]
"Lexmark X1100 Series"="C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 08:12 57344]
"wscntfy"="C:\WINDOWS\system\wscntfy.exe" [2008-02-16 09:01 81922]
"Media Codec Update Service"="C:\Arquivos de programas\Essentials Codec Pack\update.exe" [2007-04-08 13:44 303104]
"Adobe Reader Speed Launcher"="C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"windir32"="C:\WINDOWS\system32\windir32.exe" [2008-05-21 15:06 754176]
"AVG8_TRAY"="C:\ARQUIV~1\AVG\AVG8\avgtray.exe" [2008-05-25 13:32 1177368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Explorer"="C:\WINDOWS\system\ctfmon.exe" [2008-02-16 09:01 24578]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"windir32"="C:\WINDOWS\system32\windir32.exe" [2008-05-21 15:06 754176]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:45 15360]

C:\Documents and Settings\Luciano\Menu Iniciar\Programas\Inicializar\
BrOffice.org 2.3.lnk - C:\Arquivos de programas\BrOffice.org 2.3\program\quickstart.exe [2007-08-17 21:57:56 393216]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\bbrdehed]
bbrdehed.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\iifcdcb]
iifcdcb.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codec"= l3codecp.acm

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\LEXPPS.EXE"=
"C:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Arquivos de programas\\NetMeeting\\conf.exe"=
"C:\\WINDOWS\\system32\\windir32.exe"=
"C:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"C:\\Arquivos de programas\\AVG\\AVG8\\avgupd.exe"=
"C:\\Arquivos de programas\\AVG\\AVG8\\avgemc.exe"=

R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-05-25 13:32]
R2 avg8emc;AVG8 E-mail Scanner;C:\ARQUIV~1\AVG\AVG8\avgemc.exe [2008-05-25 13:32]
R2 avg8wd;AVG8 WatchDog;C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe [2008-05-25 13:32]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-05-25 13:32]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{48e901ec-0a65-11dd-bc98-000fea9e6ceb}]
\Shell\AutoRun\command - E:\i0.cmd
\Shell\explore\Command - E:\i0.cmd
\Shell\open\Command - E:\i0.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a94d0a2f-1f55-11dd-bcf7-000fea9e6ceb}]
\Shell\AutoRun\command - D:\stwi.com
\Shell\explore\Command - D:\stwi.com
\Shell\open\Command - D:\stwi.com

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-28 12:25:01
Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializ veis ocultas ...

Procurando ficheiros ocultos ...


C:\WINDOWS\system32\wmm2re4.dll 190 bytes

Varredura completada com sucesso
Ficheiros ocultos: 1

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\mnmsrvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Arquivos de programas\AVG\AVG8\avgrsx.exe
C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmon.exe
C:\Arquivos de programas\BrOffice.org 2.3\program\soffice.exe
C:\Arquivos de programas\BrOffice.org 2.3\program\soffice.bin
.
**************************************************************************
.
Tempo para conclusÆo: 2008-05-28 12:33:31 - machine was rebooted [Luciano]
ComboFix-quarantined-files.txt 2008-05-28 15:33:20

Pre-Run: 29,128,126,464 bytes disponíveis
Post-Run: 29,334,052,864 bytes dispon¡veis

157 --- E O F --- 2008-05-17 14:59:28

grato pela ajudar... aguardando resposta

Abra o Spybot Search & Destroy
No menu superior, vá em Modo e selecione a opção Avançado. Confirme.
Clique no botão Ferramentas e depois em Residente
Desmarque a opção Ativar "TeaTimer" do Residente (proteção geral das configurações de sistema).
Saia do programa.

Com o Internet Explorer, clique com o direito sobre o link TeaTimer_Reset.bat anexado no final desse post e escolha salvar destino como
Em "nome do arquivo:" escreva TeaTimer_Reset.bat
Em "Salvar com o tipo:" escolha todos os arquivos
Salve na sua área de trabalho.
Ele deverá ficar com um ícone igual a este ->

Feche qualquer janela do SpyBot e execute o arquivo TeaTimer_Reset.bat.

Obs: Esse arquivo foi feito especificamente para o seu computador, e não deve ser utilizado em nenhum outro computador.



Delete o log ComboFix.txt localizado em C:\.

Sugiro que imprima ou salve os procedimentos abaixo, e não use a internet até terminado o procedimento.

Selecione e copie o texto dentro do QUOTE (caixa cinza) abaixo. Abra o Bloco de notas e cole o que copiou. Salve então, na área de trabalho, com o nome de CFScript.txt.



Arraste agora o CFScript.txt para o ComboFix conforme a demonstração abaixo.



O ComboFix irá rodar e reiniciará o PC automaticamente para completar o processo de remoção.

IMPORTANTE: Não use o mouse nem o teclado quando o ComboFix estiver rodando.

Quando acabar, será gerado um log, que estará em C:\ComboFix.txt.

Poste o novo Log ComboFix.txt à sua resposta.

Poste também um novo Log do Hijackthis.

log do hijackthis






Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:14:27, on 28/05/08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\mnmsrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\ARQUIV~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmgr.exe
C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmon.exe
C:\ARQUIV~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\BrOffice.org 2.3\program\soffice.exe
C:\Arquivos de programas\BrOffice.org 2.3\program\soffice.BIN
C:\WINDOWS\explorer.exe
C:\Arquivos de programas\AVG\AVG8\avgrsx.exe
C:\Arquivos de programas\AVG\AVG8\avgrsx.exe
C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe
C:\Arquivos de programas\Mozilla Firefox\firefox.exe
C:\Arquivos de programas\Mozilla Firefox\firefox.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [Media Codec Update Service] C:\Arquivos de programas\Essentials Codec Pack\update.exe -silent
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARQUIV~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\RunOnce: [Explorer] C:\WINDOWS\system\ctfmon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: BrOffice.org 2.3.lnk = C:\Arquivos de programas\BrOffice.org 2.3\program\quickstart.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O17 - HKLM\System\CCS\Services\Tcpip\..\{68349F0F-15BB-4692-A3C9-EEB94F7AE479}: NameServer = 200.204.0.10,200.204.0.138
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Arquivos de programas\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

--
End of file - 5612 bytes



-----------------------------------------------------------------------------------------------------------------------------------------------------




log do ComboFIx







ComboFix 08-05-27.4 - Luciano 2008-05-28 19:50:49.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.245 [GMT -3:00]
Executando de: C:\Documents and Settings\Luciano\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Luciano\Desktop\CFScript.txt
* Criado um novo ponto de restauro

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\tot.exe
C:\WINDOWS\system\wscntfy.exe
C:\WINDOWS\system32\31861617.INS
C:\WINDOWS\system32\37224256.INS
C:\WINDOWS\system32\8204747.INS
C:\WINDOWS\system32\bbrdehed.dll
C:\WINDOWS\system32\gm2re1.pif
C:\WINDOWS\system32\iifcdcb.dll
C:\WINDOWS\system32\mirc.ini
C:\WINDOWS\system32\secus16.exe
C:\WINDOWS\system32\windir32.exe
C:\WINDOWS\system32\windir32.zip
C:\WINDOWS\system32\WMM2RE2.dll
C:\WINDOWS\system32\WMM2RE3.dll
C:\WINDOWS\system32\wmm2re4.dll
D:\stwi.com
E:\i0.cmd
.

((((((((((((((((((((((((((((((((((((( Outras Exclusäes )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\tot.exe
C:\WINDOWS\system\wscntfy.exe
C:\WINDOWS\system32\31861617.INS
C:\WINDOWS\system32\37224256.INS
C:\WINDOWS\system32\8204747.INS
C:\WINDOWS\system32\gm2re1.pif
C:\WINDOWS\system32\mirc.ini
C:\WINDOWS\system32\secus16.exe
C:\WINDOWS\system32\windir32.exe
C:\WINDOWS\system32\windir32.zip
C:\WINDOWS\system32\WMM2RE2.dll
C:\WINDOWS\system32\WMM2RE3.dll
C:\WINDOWS\system32\wmm2re4.dll

.
((((((((((((((((((((((( Ficheiros criados de 2008-04-28 to 2008-05-28 ))))))))))))))))))))))))))))))))
.

2008-05-28 12:33 . 2008-05-28 12:33 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\Configurações locais
2008-05-28 12:33 . 2008-05-28 12:33 <DIR> d-------- C:\Documents and Settings\NetworkService\Configurações locais
2008-05-28 12:33 . 2008-05-28 12:33 <DIR> d-------- C:\Documents and Settings\Luciano\Configurações locais
2008-05-28 12:33 . 2008-05-28 12:33 <DIR> d-------- C:\Documents and Settings\LocalService\Configurações locais
2008-05-26 15:20 . 2008-05-26 15:20 <DIR> d-------- C:\Arquivos de programas\Trend Micro
2008-05-25 13:48 . 2008-05-28 19:35 <DIR> d--h----- C:\$AVG8.VAULT$
2008-05-25 13:34 . 2008-05-25 13:23 691,545 --a------ C:\WINDOWS\unins000.exe
2008-05-25 13:34 . 2008-05-25 13:34 2,555 --a------ C:\WINDOWS\unins000.dat
2008-05-25 13:32 . 2008-05-28 15:59 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-05-25 13:32 . 2008-05-28 12:59 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\avg8
2008-05-25 13:32 . 2008-05-25 13:32 <DIR> d-------- C:\Arquivos de programas\AVG
2008-05-25 13:32 . 2008-05-25 13:32 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-05-25 13:32 . 2008-05-25 13:32 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-05-25 13:32 . 2008-05-25 13:32 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-05-24 10:13 . 2008-05-24 10:13 <DIR> d-------- C:\WINDOWS\system32\sounds
2008-05-24 10:13 . 2008-05-24 10:13 <DIR> d-------- C:\WINDOWS\system32\logs
2008-05-14 00:36 . 2008-05-14 00:36 <DIR> d-------- C:\Documents and Settings\Luciano\Dados de aplicativos\pdf995
2008-05-14 00:36 . 2008-05-14 00:36 28 --a------ C:\WINDOWS\pdf995.ini

.
((((((((((((((((((((((((((((((((((((( Relat¢rio Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-28 22:34 --------- d-----w C:\Arquivos de programas\microsoft frontpage
2008-05-28 19:15 --------- d-----w C:\Documents and Settings\Luciano\Dados de aplicativos\BrOffice.org2
2008-05-27 00:34 --------- d-----w C:\Arquivos de programas\Zuma Deluxe
2008-05-27 00:33 --------- d-----w C:\Arquivos de programas\Acro Software
2008-05-25 16:48 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy
2008-05-25 16:46 --------- d-----w C:\Arquivos de programas\Spybot - Search & Destroy
2008-05-25 03:46 --------- d-----w C:\Arquivos de programas\Windows Live Safety Center
2008-05-14 03:37 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\pdf995
2008-05-14 03:32 51,716 ----a-w C:\WINDOWS\system32\pdf995mon.dll
2008-05-14 03:32 249,856 ----a-w C:\WINDOWS\system32\pdfmona.dll
2008-05-14 02:08 --------- d-----w C:\Arquivos de programas\Lexmark X1100 Series
2008-04-20 18:23 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft Help
2008-04-19 13:22 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Adobe
2008-04-15 02:54 --------- d-----w C:\Arquivos de programas\pdf995
2008-04-11 21:34 --------- d-----w C:\Documents and Settings\Luciano\Dados de aplicativos\Dev-Cpp
2008-04-04 22:25 --------- d-----w C:\Arquivos de programas\7-Zip
2008-03-29 14:41 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\WinZip
2008-03-29 14:38 --------- d-----w C:\Arquivos de programas\PicPerk
2008-03-29 14:19 --------- d-----w C:\Arquivos de programas\eMule
2008-03-28 14:59 --------- d-----w C:\Arquivos de programas\Programas RFB
2008-03-25 04:49 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:49 183,072 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-01 21:32 3,591,680 ----a-w C:\WINDOWS\system32\SET107.tmp
2008-03-01 13:02 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-03-01 13:02 826,368 ----a-w C:\WINDOWS\system32\SETFD.tmp
2008-03-01 13:02 63,488 ----a-w C:\WINDOWS\system32\SET116.tmp
2008-03-01 13:02 6,066,176 ----a-w C:\WINDOWS\system32\SET10F.tmp
2008-03-01 13:02 52,224 ----a-w C:\WINDOWS\system32\SET108.tmp
2008-03-01 13:02 459,264 ----a-w C:\WINDOWS\system32\SET109.tmp
2008-03-01 13:02 383,488 ----a-w C:\WINDOWS\system32\SET111.tmp
2008-03-01 13:02 267,776 ----a-w C:\WINDOWS\system32\SET10D.tmp
2008-03-01 13:02 124,928 ----a-w C:\WINDOWS\system32\SET119.tmp
2008-03-01 13:02 105,984 ----a-w C:\WINDOWS\system32\SET100.tmp
2008-03-01 13:02 1,159,680 ----a-w C:\WINDOWS\system32\SETFF.tmp
2008-01-03 01:44 774,144 ----a-w C:\Arquivos de programas\RngInterstitial.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of C:\WINDOWS\system32\logs ----


---- Directory of C:\WINDOWS\system32\sounds ----



((((((((((((((((((((((((((((( snapshot@2008-05-28_12.32.42.32 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-28 15:20:06 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-28 22:56:23 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-28 22:57:07 40,960 ----a-w C:\WINDOWS\TEMP\rtdrvmon.exe
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* entradas vazias & leg¡timas por defeito nÆo sÆo mostradas.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:45 15360]
"MSMSGS"="C:\Arquivos de programas\Messenger\msmsgs.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2003-02-27 14:29 47104 C:\WINDOWS\SOUNDMAN.EXE]
"Lexmark X1100 Series"="C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 08:12 57344]
"Media Codec Update Service"="C:\Arquivos de programas\Essentials Codec Pack\update.exe" [2007-04-08 13:44 303104]
"Adobe Reader Speed Launcher"="C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"AVG8_TRAY"="C:\ARQUIV~1\AVG\AVG8\avgtray.exe" [2008-05-25 13:32 1177368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Explorer"="C:\WINDOWS\system\ctfmon.exe" [2008-02-16 09:01 24578]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:45 15360]

C:\Documents and Settings\Luciano\Menu Iniciar\Programas\Inicializar\
BrOffice.org 2.3.lnk - C:\Arquivos de programas\BrOffice.org 2.3\program\quickstart.exe [2007-08-17 21:57:56 393216]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codec"= l3codecp.acm

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\LEXPPS.EXE"=
"C:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Arquivos de programas\\NetMeeting\\conf.exe"=
"C:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"C:\\Arquivos de programas\\AVG\\AVG8\\avgupd.exe"=
"C:\\Arquivos de programas\\AVG\\AVG8\\avgemc.exe"=

R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-05-25 13:32]
R2 avg8emc;AVG8 E-mail Scanner;C:\ARQUIV~1\AVG\AVG8\avgemc.exe [2008-05-25 13:32]
R2 avg8wd;AVG8 WatchDog;C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe [2008-05-25 13:32]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-05-25 13:32]

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-28 19:57:17
Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializ veis ocultas ...

Procurando ficheiros ocultos ...

Varredura completada com sucesso
Ficheiros ocultos: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\mnmsrvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmon.exe
C:\Arquivos de programas\BrOffice.org 2.3\program\soffice.exe
C:\Arquivos de programas\BrOffice.org 2.3\program\soffice.bin
C:\Arquivos de programas\AVG\AVG8\avgrsx.exe
C:\Arquivos de programas\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Tempo para conclusÆo: 2008-05-28 20:05:17 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-28 23:05:12

Pre-Run: 28,913,262,592 bytes disponíveis
Post-Run: 29,087,293,440 bytes dispon¡veis

181 --- E O F --- 2008-05-17 14:59:28




grato pela ajufa, aguardo resposta

Delete o log ComboFix.txt localizado em C:\.

Sugiro que imprima ou salve os procedimentos abaixo, e não use a internet até terminado o procedimento.

Selecione e copie o texto dentro do QUOTE (caixa cinza) abaixo. Abra o Bloco de notas e cole o que copiou. Salve então, na área de trabalho, com o nome de CFScript.txt.



Arraste agora o CFScript.txt para o ComboFix conforme a demonstração abaixo.



O ComboFix irá rodar e reiniciará o PC automaticamente para completar o processo de remoção.

IMPORTANTE: Não use o mouse nem o teclado quando o ComboFix estiver rodando.

Quando acabar, será gerado um log, que estará em C:\ComboFix.txt.

Poste o novo Log ComboFix.txt à sua resposta.

Poste também um novo Log do Hijackthis.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:09:27, on 31/05/08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\mnmsrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\ARQUIV~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\Arquivos de programas\AVG\AVG8\avgrsx.exe
C:\Arquivos de programas\AVG\AVG8\avgrsx.exe
C:\WINDOWS\explorer.exe
C:\ARQUIV~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [Media Codec Update Service] C:\Arquivos de programas\Essentials Codec Pack\update.exe -silent
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARQUIV~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [wscntfy] C:\WINDOWS\system\wscntfy.exe
O4 - HKLM\..\RunOnce: [!CleanupNetMeetingDispDriver] "C:\WINDOWS\system32\rundll32.exe" msconf.dll,CleanupNetMeetingDispDriver 0
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: BrOffice.org 2.3.lnk = C:\Arquivos de programas\BrOffice.org 2.3\program\quickstart.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O17 - HKLM\System\CCS\Services\Tcpip\..\{68349F0F-15BB-4692-A3C9-EEB94F7AE479}: NameServer = 200.204.0.10,200.204.0.138
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Arquivos de programas\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

--
End of file - 5326 bytes




________________________________________________________________________________
__________




ComboFix 08-05-27.4 - Luciano 2008-05-31 10:52:26.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.252 [GMT -3:00]
Executando de: C:\Documents and Settings\Luciano\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Luciano\Desktop\CFScript.txt..txt
* Criado um novo ponto de restauro

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\system\ctfmon.exe
.

((((((((((((((((((((((((((((((((((((( Outras Exclusäes )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system\ctfmon.exe
C:\WINDOWS\system32\logs
C:\WINDOWS\system32\sounds

.
((((((((((((((((((((((( Ficheiros criados de 2008-04-28 to 2008-05-31 ))))))))))))))))))))))))))))))))
.

2008-05-28 12:33 . 2008-05-28 20:05 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\Configurações locais
2008-05-28 12:33 . 2008-05-28 20:05 <DIR> d-------- C:\Documents and Settings\NetworkService\Configurações locais
2008-05-28 12:33 . 2008-05-28 20:05 <DIR> d-------- C:\Documents and Settings\Luciano\Configurações locais
2008-05-28 12:33 . 2008-05-28 20:05 <DIR> d-------- C:\Documents and Settings\LocalService\Configurações locais
2008-05-26 15:20 . 2008-05-26 15:20 <DIR> d-------- C:\Arquivos de programas\Trend Micro
2008-05-25 13:48 . 2008-05-29 12:53 <DIR> d--h----- C:\$AVG8.VAULT$
2008-05-25 13:34 . 2008-05-25 13:23 691,545 --a------ C:\WINDOWS\unins000.exe
2008-05-25 13:34 . 2008-05-25 13:34 2,555 --a------ C:\WINDOWS\unins000.dat
2008-05-25 13:32 . 2008-05-30 17:24 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-05-25 13:32 . 2008-05-28 12:59 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\avg8
2008-05-25 13:32 . 2008-05-25 13:32 <DIR> d-------- C:\Arquivos de programas\AVG
2008-05-25 13:32 . 2008-05-25 13:32 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-05-25 13:32 . 2008-05-25 13:32 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-05-25 13:32 . 2008-05-25 13:32 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-05-14 00:36 . 2008-05-14 00:36 <DIR> d-------- C:\Documents and Settings\Luciano\Dados de aplicativos\pdf995
2008-05-14 00:36 . 2008-05-14 00:36 28 --a------ C:\WINDOWS\pdf995.ini
2008-04-20 11:19 . 2008-04-20 15:23 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft Help
2008-04-19 11:14 . 2001-09-05 23:20 12,288 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-04-19 11:14 . 2001-09-05 23:20 12,288 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
2008-04-19 11:14 . 2001-08-17 22:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-04-19 11:14 . 2001-08-17 22:02 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys
2008-04-19 10:22 . 2008-04-19 10:22 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Adobe
2008-04-14 23:54 . 2008-05-26 21:33 <DIR> d-------- C:\Arquivos de programas\Acro Software
2008-04-14 23:48 . 2008-05-14 00:37 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\pdf995
2008-04-14 23:48 . 2008-04-14 23:54 <DIR> d-------- C:\Arquivos de programas\pdf995
2008-04-14 23:48 . 2008-05-14 00:32 249,856 --a------ C:\WINDOWS\system32\pdfmona.dll
2008-04-14 23:48 . 2008-05-14 00:32 51,716 --a------ C:\WINDOWS\system32\pdf995mon.dll
2008-04-14 23:48 . 2008-05-14 00:37 59 --a------ C:\WINDOWS\wpd99.drv
2008-04-11 19:53 . 2008-04-11 19:53 18 --a------ C:\WINDOWS\system\dxmas.sys
2008-04-08 15:16 . 2008-03-01 10:02 6,066,176 --a------ C:\WINDOWS\system32\SET10F.tmp
2008-04-08 15:16 . 2008-03-01 10:02 1,159,680 --a------ C:\WINDOWS\system32\SETFF.tmp
2008-04-08 15:16 . 2008-03-01 10:02 826,368 --a------ C:\WINDOWS\system32\SETFD.tmp
2008-04-08 15:16 . 2008-03-01 10:02 459,264 --a------ C:\WINDOWS\system32\SET109.tmp
2008-04-08 15:16 . 2008-03-01 10:02 383,488 --a------ C:\WINDOWS\system32\SET111.tmp
2008-04-08 15:16 . 2008-03-01 10:02 267,776 --a------ C:\WINDOWS\system32\SET10D.tmp
2008-04-08 15:16 . 2008-03-01 10:02 124,928 --a------ C:\WINDOWS\system32\SET119.tmp
2008-04-08 15:16 . 2008-03-01 10:02 105,984 --a------ C:\WINDOWS\system32\SET100.tmp
2008-04-08 15:16 . 2008-03-01 10:02 63,488 --a------ C:\WINDOWS\system32\SET116.tmp
2008-04-08 15:16 . 2008-03-01 10:02 52,224 --a------ C:\WINDOWS\system32\SET108.tmp
2008-04-04 19:25 . 2008-04-04 19:25 <DIR> d-------- C:\Arquivos de programas\7-Zip

.
((((((((((((((((((((((((((((((((((((( Relat¢rio Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-31 13:29 --------- d-----w C:\Documents and Settings\Luciano\Dados de aplicativos\BrOffice.org2
2008-05-29 16:28 --------- d-----w C:\Arquivos de programas\microsoft frontpage
2008-05-27 00:34 --------- d-----w C:\Arquivos de programas\Zuma Deluxe
2008-05-25 16:48 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy
2008-05-25 16:46 --------- d-----w C:\Arquivos de programas\Spybot - Search & Destroy
2008-05-25 03:46 --------- d-----w C:\Arquivos de programas\Windows Live Safety Center
2008-05-14 02:08 --------- d-----w C:\Arquivos de programas\Lexmark X1100 Series
2008-04-11 21:34 --------- d-----w C:\Documents and Settings\Luciano\Dados de aplicativos\Dev-Cpp
2008-03-29 14:41 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\WinZip
2008-03-29 14:38 --------- d-----w C:\Arquivos de programas\PicPerk
2008-03-29 14:19 --------- d-----w C:\Arquivos de programas\eMule
2008-03-28 14:59 --------- d-----w C:\Arquivos de programas\Programas RFB
2008-03-25 04:49 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:49 183,072 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-01 21:32 3,591,680 ----a-w C:\WINDOWS\system32\SET107.tmp
2008-03-01 13:02 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-26 12:00 294,912 ----a-w C:\WINDOWS\system32\msctf.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:37 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-16 12:00 172,034 ----a-w C:\WINDOWS\system32\OSSMTP.dll
2008-01-03 01:44 774,144 ----a-w C:\Arquivos de programas\RngInterstitial.dll
.

((((((((((((((((((((((((((((( snapshot@2008-05-28_12.32.42.32 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-28 15:20:06 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-31 13:56:32 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2004-08-04 03:45:24 294,400 -c--a-w C:\WINDOWS\system32\dllcache\msctf.dll
+ 2008-02-26 12:00:47 294,912 -c--a-w C:\WINDOWS\system32\dllcache\msctf.dll
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* entradas vazias & leg¡timas por defeito nÆo sÆo mostradas.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:45 15360]
"MSMSGS"="C:\Arquivos de programas\Messenger\msmsgs.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2003-02-27 14:29 47104 C:\WINDOWS\SOUNDMAN.EXE]
"Lexmark X1100 Series"="C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 08:12 57344]
"Media Codec Update Service"="C:\Arquivos de programas\Essentials Codec Pack\update.exe" [2007-04-08 13:44 303104]
"Adobe Reader Speed Launcher"="C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"AVG8_TRAY"="C:\ARQUIV~1\AVG\AVG8\avgtray.exe" [2008-05-25 13:32 1177368]
"wscntfy"="C:\WINDOWS\system\wscntfy.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"!CleanupNetMeetingDispDriver"="C:\WINDOWS\system32\rundll32.exe" [2004-08-04 00:45 33280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:45 15360]

C:\Documents and Settings\Luciano\Menu Iniciar\Programas\Inicializar\
BrOffice.org 2.3.lnk - C:\Arquivos de programas\BrOffice.org 2.3\program\quickstart.exe [2007-08-17 21:57:56 393216]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codec"= l3codecp.acm

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\LEXPPS.EXE"=
"C:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Arquivos de programas\\NetMeeting\\conf.exe"=
"C:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"C:\\Arquivos de programas\\AVG\\AVG8\\avgupd.exe"=
"C:\\Arquivos de programas\\AVG\\AVG8\\avgemc.exe"=

R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-05-25 13:32]
R2 avg8emc;AVG8 E-mail Scanner;C:\ARQUIV~1\AVG\AVG8\avgemc.exe [2008-05-25 13:32]
R2 avg8wd;AVG8 WatchDog;C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe [2008-05-25 13:32]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-05-25 13:32]

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-31 10:57:30
Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializ veis ocultas ...

Procurando ficheiros ocultos ...

Varredura completada com sucesso
Ficheiros ocultos: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\mnmsrvc.exe
C:\Arquivos de programas\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Tempo para conclusÆo: 2008-05-31 11:06:01 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-31 14:05:57

Pre-Run: 28,909,211,648 bytes disponíveis
Post-Run: 28,904,509,440 bytes dispon¡veis

156 --- E O F --- 2008-05-29 02:23:32







grato pela ajuda e aguardando resposta....

Delete o log ComboFix.txt localizado em C:\.

Sugiro que imprima ou salve os procedimentos abaixo, e não use a internet até terminado o procedimento.

Selecione e copie o texto dentro do QUOTE (caixa cinza) abaixo. Abra o Bloco de notas e cole o que copiou. Salve então, na área de trabalho, com o nome de CFScript.txt.



Arraste agora o CFScript.txt para o ComboFix conforme a demonstração abaixo.



O ComboFix irá rodar e reiniciará o PC automaticamente para completar o processo de remoção.

IMPORTANTE: Não use o mouse nem o teclado quando o ComboFix estiver rodando.

Quando acabar, será gerado um log, que estará em C:\ComboFix.txt.

Poste o novo Log ComboFix.txt à sua resposta.

Poste também um novo Log do Hijackthis.

ComboFix 08-05-27.4 - Luciano 2008-06-07 14:22:44.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.266 [GMT -3:00]
Executando de: C:\Documents and Settings\Luciano\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Luciano\Desktop\CFScript.txt..txt
* Criado um novo ponto de restauro

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\system\wscntfy.exe
.

((((((((((((((((((((((( Ficheiros criados de 2008-05-07 to 2008-06-07 ))))))))))))))))))))))))))))))))
.

2008-06-02 21:44 . 2008-06-03 12:16 <DIR> d-------- C:\Arquivos de programas\Central de Jogos
2008-06-02 21:44 . 2001-04-04 16:01 2,023,424 -ra------ C:\WINDOWS\system32\vcl50.bpl
2008-06-02 21:44 . 2001-11-14 17:48 692,736 -ra------ C:\WINDOWS\system32\firstclass2000_vcl5.bpl
2008-06-02 21:44 . 2001-04-04 16:01 558,080 -ra------ C:\WINDOWS\system32\vcldb50.bpl
2008-06-02 21:44 . 2001-04-04 16:01 387,072 -ra------ C:\WINDOWS\system32\dss50.bpl
2008-06-02 21:44 . 2001-04-04 16:01 300,032 -ra------ C:\WINDOWS\system32\vclbde50.bpl
2008-06-02 21:44 . 2001-04-04 16:01 248,832 -ra------ C:\WINDOWS\system32\vclx50.bpl
2008-05-28 12:33 . 2008-06-02 17:26 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\Configurações locais
2008-05-28 12:33 . 2008-06-02 17:26 <DIR> d-------- C:\Documents and Settings\NetworkService\Configurações locais
2008-05-28 12:33 . 2008-06-02 17:26 <DIR> d-------- C:\Documents and Settings\Luciano\Configurações locais
2008-05-28 12:33 . 2008-06-02 17:26 <DIR> d-------- C:\Documents and Settings\LocalService\Configurações locais
2008-05-26 15:20 . 2008-05-26 15:20 <DIR> d-------- C:\Arquivos de programas\Trend Micro
2008-05-25 13:48 . 2008-05-29 12:53 <DIR> d--h----- C:\$AVG8.VAULT$
2008-05-25 13:34 . 2008-05-25 13:23 691,545 --a------ C:\WINDOWS\unins000.exe
2008-05-25 13:34 . 2008-05-25 13:34 2,555 --a------ C:\WINDOWS\unins000.dat
2008-05-25 13:32 . 2008-06-07 14:21 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-05-25 13:32 . 2008-05-28 12:59 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\avg8
2008-05-25 13:32 . 2008-05-25 13:32 <DIR> d-------- C:\Arquivos de programas\AVG
2008-05-25 13:32 . 2008-05-25 13:32 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-05-25 13:32 . 2008-05-25 13:32 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-05-25 13:32 . 2008-05-25 13:32 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-05-14 00:36 . 2008-05-14 00:36 <DIR> d-------- C:\Documents and Settings\Luciano\Dados de aplicativos\pdf995
2008-05-14 00:36 . 2008-05-14 00:36 28 --a------ C:\WINDOWS\pdf995.ini

.
((((((((((((((((((((((((((((((((((((( Relat¢rio Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-07 17:59 --------- d-----w C:\Documents and Settings\Luciano\Dados de aplicativos\BrOffice.org2
2008-05-29 16:28 --------- d-----w C:\Arquivos de programas\microsoft frontpage
2008-05-27 00:34 --------- d-----w C:\Arquivos de programas\Zuma Deluxe
2008-05-27 00:33 --------- d-----w C:\Arquivos de programas\Acro Software
2008-05-25 16:48 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy
2008-05-25 16:46 --------- d-----w C:\Arquivos de programas\Spybot - Search & Destroy
2008-05-25 03:46 --------- d-----w C:\Arquivos de programas\Windows Live Safety Center
2008-05-14 03:37 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\pdf995
2008-05-14 02:08 --------- d-----w C:\Arquivos de programas\Lexmark X1100 Series
2008-04-20 18:23 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft Help
2008-04-19 13:22 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Adobe
2008-04-15 02:54 --------- d-----w C:\Arquivos de programas\pdf995
2008-04-11 21:34 --------- d-----w C:\Documents and Settings\Luciano\Dados de aplicativos\Dev-Cpp
2008-01-03 01:44 774,144 ----a-w C:\Arquivos de programas\RngInterstitial.dll
.

((((((((((((((((((((((((((((( snapshot@2008-05-28_12.32.42.32 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-28 15:20:06 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-07 17:26:31 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2004-08-04 03:45:24 294,400 -c--a-w C:\WINDOWS\system32\dllcache\msctf.dll
+ 2008-02-26 12:00:47 294,912 -c--a-w C:\WINDOWS\system32\dllcache\msctf.dll
- 2004-08-04 03:45:24 294,400 ----a-w C:\WINDOWS\system32\MSCTF.dll
+ 2008-02-26 12:00:47 294,912 ----a-w C:\WINDOWS\system32\msctf.dll
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* entradas vazias & leg¡timas por defeito nÆo sÆo mostradas.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:45 15360]
"MSMSGS"="C:\Arquivos de programas\Messenger\msmsgs.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2003-02-27 14:29 47104 C:\WINDOWS\SOUNDMAN.EXE]
"Lexmark X1100 Series"="C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 08:12 57344]
"Media Codec Update Service"="C:\Arquivos de programas\Essentials Codec Pack\update.exe" [2007-04-08 13:44 303104]
"Adobe Reader Speed Launcher"="C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"AVG8_TRAY"="C:\ARQUIV~1\AVG\AVG8\avgtray.exe" [2008-05-25 13:32 1177368]
"wscntfy"="C:\WINDOWS\system\wscntfy.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:45 15360]

C:\Documents and Settings\Luciano\Menu Iniciar\Programas\Inicializar\
BrOffice.org 2.3.lnk - C:\Arquivos de programas\BrOffice.org 2.3\program\quickstart.exe [2007-08-17 21:57:56 393216]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codec"= l3codecp.acm

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\LEXPPS.EXE"=
"C:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Arquivos de programas\\NetMeeting\\conf.exe"=
"C:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"C:\\Arquivos de programas\\AVG\\AVG8\\avgupd.exe"=
"C:\\Arquivos de programas\\AVG\\AVG8\\avgemc.exe"=

R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-05-25 13:32]
R2 avg8emc;AVG8 E-mail Scanner;C:\ARQUIV~1\AVG\AVG8\avgemc.exe [2008-05-25 13:32]
R2 avg8wd;AVG8 WatchDog;C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe [2008-05-25 13:32]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-05-25 13:32]

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-07 14:58:28
Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializ veis ocultas ...

Procurando ficheiros ocultos ...

Varredura completada com sucesso
Ficheiros ocultos: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\mnmsrvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Arquivos de programas\AVG\AVG8\avgrsx.exe
C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmon.exe
C:\Arquivos de programas\BrOffice.org 2.3\program\soffice.exe
C:\Arquivos de programas\BrOffice.org 2.3\program\soffice.bin
.
**************************************************************************
.
Tempo para conclusÆo: 2008-06-07 15:05:57 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-07 18:05:53
ComboFix2.txt 2008-05-31 14:06:02

Pre-Run: 28,933,902,336 bytes disponíveis
Post-Run: 28,925,263,872 bytes dispon¡veis

130 --- E O F --- 2008-05-29 02:23:32




||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||

||||||||||||||||||||||||||||||||||||||||||||||




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:26:26, on 07/06/08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\mnmsrvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\svchost.exe
C:\ARQUIV~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmgr.exe
C:\ARQUIV~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Arquivos de programas\AVG\AVG8\avgrsx.exe
C:\Arquivos de programas\Mozilla Firefox\firefox.exe
C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [Media Codec Update Service] C:\Arquivos de programas\Essentials Codec Pack\update.exe -silent
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARQUIV~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [wscntfy] C:\WINDOWS\system\wscntfy.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: BrOffice.org 2.3.lnk = C:\Arquivos de programas\BrOffice.org 2.3\program\quickstart.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O17 - HKLM\System\CCS\Services\Tcpip\..\{68349F0F-15BB-4692-A3C9-EEB94F7AE479}: NameServer = 200.204.0.10,200.204.0.138
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Arquivos de programas\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

--
End of file - 5317 bytes


Desculpe a demora para responder, mais meu dia ta muiito corrido com a semana da prova,
grato pela ajuda e aguardo respostas....

Abra o Hijackthis, clique em Do scan a system only, marque a entrada abaixo e clique no botão

O4 - HKLM\..\Run: [wscntfy] C:\WINDOWS\system\wscntfy.exe

Reinicie e poste um novo Log do Hijackthis feito em Modo Normal.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:33:19, on 08/06/08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\mnmsrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\ARQUIV~1\AVG\AVG8\avgrsx.exe
C:\ARQUIV~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmgr.exe
C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmon.exe
C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\ARQUIV~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\BrOffice.org 2.3\program\soffice.exe
C:\Arquivos de programas\BrOffice.org 2.3\program\soffice.BIN
C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe
C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe
C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [Media Codec Update Service] C:\Arquivos de programas\Essentials Codec Pack\update.exe -silent
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARQUIV~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: BrOffice.org 2.3.lnk = C:\Arquivos de programas\BrOffice.org 2.3\program\quickstart.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O17 - HKLM\System\CCS\Services\Tcpip\..\{68349F0F-15BB-4692-A3C9-EEB94F7AE479}: NameServer = 200.204.0.10,200.204.0.138
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Arquivos de programas\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

--
End of file - 5541 bytes

Versões antigas e desatualizadas, estão mais vulneráveis aos malwares.

• Faça o download da última versão do Java Runtime Environment (JRE) 6 Update 6 e salve no seu ambiente de trabalho (Desktop).
• Navegue até "Java Runtime Environment (JRE) 6 Update 6...allows end-users to run Java applications".
• Clique em "Download". (está do lado direito)
• Selecione a sua Plataforma: "Windows".
• Selecione a sua linguagem: "Português".
• Leia a Licença de uso e marque a caixa: "Accept License Agreement".
• Clique "Continue".
• Clique no link para download Windows Offline Installation e salve o arquivo no seu Ambiente de Trabalho.
• Feche todos os programas que esteja usar. Especialmente o seu Navegador (IE, Firefox, etc)
• Clique em Iniciar -> Configurações -> Painel de Controle, duplo clique em Adicionar/Remover Programas e remova todas as versões antigas de Java.
• Marque qualquer item , que tenha no nome: Java Runtime Environment (JRE ou J2SE). Deverá ter um icone como este
• Clique em Remover ou Modificar/Remover.
• Repita quantas vezes for necessário, até que tenha removido todas as versões antigas de Java que existam no seu PC.
• Reinicie o seu PC, após ter removido as versões antigas de Java.
• Dê agora o duplo-clique em jre-6u6-windows-i586-p (está no seu desktop), para instalar a nova e mais segura versão de Java.

Clique em Iniciar -> Executar -> digite ComboFix.exe /u -> Ok.



Aguarde a deinstalação.


Clique em Iniciar -> Configurações -> Painel de Controle -> Abra o item Sistema.

Clique na guia Restauração do Sistema -> Marque Desativar restauração do sistemas em todas as unidades -> Em seguida clique em Aplicar. Após aplicado, desmarque a caixa Desativar restauração do sistemas em todas as unidades e clique novamente em Aplicar depois Ok.

Seu Log está limpo. Ainda há algum problema com o PC?

o computado esta legal agora, fico muiiito bom, muiito obrigado pela ajuda...

Caso Resolvido.

Caso o autor queira a reabertura do tópico, envie uma MP com o link para um moderador da seção.