pc apresenta virus ? [Arquivo]

Ver Versão Completa : pc apresenta virus ?

CCV_Blackout

30-05-2009, 11:35 PM

Logfile of Spyware Terminator v2.5.6.316 (db:3.005.029.000)
Scan Time: 30/5/2009 23:20:04 length: 832 s
Platform: WXP (5.1.0.2600)
User: Admin
Boot Mode: Normal
Scan type: Full_Spyware_Scan
Scanned Objects: 60003 (Critical:7)
Filter: No System items, No Safe items, No Invalid items

Running Processes
Apache.exe : C:\AppServ\Apache\Apache.exe
sqlservr.exe [Microsoft Corporation] : C:\Arquivos de programas\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
Apache.exe : C:\AppServ\Apache\Apache.exe
STacSV.exe [IDT, Inc.] : C:\Arquivos de programas\idt\ecsxpv_5762_010208\wdm\STacSV.exe
sqlagent.exe [Microsoft Corporation] : C:\Arquivos de programas\Microsoft SQL Server\MSSQL\Binn\sqlagent.exe
igfxsrvc.exe [Intel Corporation] : C:\WINDOWS\system32\igfxsrvc.exe
sttray.exe [IDT, Inc.] : C:\Arquivos de programas\IDT\WDM\sttray.exe

Internet Settings
R - HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60341
R - HKLM\Software\Microsoft\Internet Explorer\Main, SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R - HKLM\Software\Microsoft\Internet Explorer\Main, CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341
R - HKLM\Software\Microsoft\Internet Explorer\Main, Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
R - HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R - HKLM\Software\Microsoft\Internet Explorer\Search, CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341
R - HKLM\System\CurrentControlSet\Services\Tcpip\Param eters, Domain =
R - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Tel ephony, DomainName =

BHO
02 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - [Microsoft Corporation] : C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll
02 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - : C:\Arquivos de programas\Free Download Manager\iefdm2.dll
02 - BHO: Groove Folder Synchronization - {2A541AE1-5BF6-4665-A8A3-CFA9672E4291} - [Microsoft Corporation] : C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll

Explorer Bars
Groove Folder Synchronization - {2A541AE1-5BF6-4665-A8A3-CFA9672E4291} - [Microsoft Corporation] : C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll

Shell Extensions
Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - [Microsoft Corporation] : C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll
Groove Folder Synchronization - {2A541AE1-5BF6-4665-A8A3-CFA9672E4291} - [Microsoft Corporation] : C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll
Groove GFS Stub Icon Handler - {A449600E-1DC6-4232-B948-9BD794D62056} - [Microsoft Corporation] : C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll
Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - [Microsoft Corporation] : C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll
Groove GFS Context Menu Handler - {6C467336-8281-4E60-8204-430CED96822D} - [Microsoft Corporation] : C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll
Groove XML Icon Handler - {387E725D-DC16-4D76-B310-2C93ED4752A0} - [Microsoft Corporation] : C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll
Groove Explorer Icon Overlay 3 (GFS Folder) - {16F3DD56-1AF5-4347-846D-7C10C4192619} - [Microsoft Corporation] : C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll
Groove Explorer Icon Overlay 2 (GFS Stub) - {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} - [Microsoft Corporation] : C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll
Groove Explorer Icon Overlay 4 (GFS Unread Mark) - {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} - [Microsoft Corporation] : C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll
Groove Explorer Icon Overlay 1 (GFS Unread Stub) - {99FD978C-D287-4F50-827F-B2C658EDA8E7} - [Microsoft Corporation] : C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll
Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) - {920E6DB1-9907-4370-B3A0-BAFC03D81399} - [Microsoft Corporation] : C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll
Microsoft Office OneNote Namespace Extension for Windows Desktop Search - {5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} - [Microsoft Corporation] : C:\Arquivos de programas\Microsoft Office\Office12\ONFILTER.DLL
WinRAR - {B41DB860-8EE4-11D2-9906-E49FADC173CA} - [Alexander Roshal] : C:\Arquivos de programas\WinRAR\rarext.dll

Shell Extecute Hooks
Groove GFS Stub Execution Hook - {{B5A7F190-DDA6-4420-B3BA-52453494E6CD}} - [Microsoft Corporation] : C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll

Services
23 - [Meetinghouse Data Communications] : C:\WINDOWS\system32\DRIVERS\AegisP.sys
23 - : C:\AppServ\Apache\Apache.exe
23 - [Intel Corporation] : C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
23 - [Microsoft Corporation] : C:\Arquivos de programas\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
23 - : C:\WINDOWS\system32\drivers\oreans32.sys
23 - [Ralink Technology Inc.] : C:\WINDOWS\system32\DRIVERS\RT2500.sys
23 - [Microsoft Corporation] : C:\Arquivos de programas\Microsoft SQL Server\MSSQL\Binn\sqlagent.exe
23 - [IDT, Inc.] : C:\Arquivos de programas\idt\ecsxpv_5762_010208\wdm\STacSV.exe
23 - [IDT, Inc.] : C:\WINDOWS\system32\drivers\sthda.sys
23 - [Vimicro Corporation] : C:\WINDOWS\system32\drivers\vvftav211.sys
23 - [Sygate Technologies, Inc.] : C:\WINDOWS\system32\Drivers\wg4n.sys
23 - [Sygate Technologies, Inc.] : C:\WINDOWS\system32\Drivers\wg5n.sys
23 - [Sygate Technologies, Inc.] : C:\WINDOWS\system32\Drivers\wg6n.sys
23 - [ZSMC.Corporation] : C:\WINDOWS\system32\Drivers\ZS211.sys
23 - [Crawler.com] : C:\WINDOWS\system32\drivers\sp_rsdrv2.sys

Winlogon Notify
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui, DLLName : [Intel Corporation] : C:\WINDOWS\system32\igfxdev.dll

Threat Files
<Trojan.Lineage.INT> : C:\Documents and Settings\User\Configurações locais\Temp\E_4\krnln.fnr
<Trojan.Agent2.cdb> : C:\WINDOWS\system32\scrnrdr.exe
<AdTool.MyWebSearch.bm> : C:\Documents and Settings\User\Configurações locais\Temp\NERO13364\Toolbar.exe
<RiskTool.Reboot.g> : C:\WINDOWS\pss\Reboot.exeCommon Startup
<Trojan.Downloader.Dadobra.bru> : C:\WINDOWS\system32\Tools\Regexe.exe
<RiskTool.Reboot.j> : C:\WINDOWS\system32\Tools\Restart.exe

Advanced Files Report
%SYSDIR%\igfxdev.dll [Intel Corporation] [Intel(R) Common User Interface] MD5=B88E363E0C5270BEC9AB1D41C5155833 SIZE=204800
%SystemDiskRoot%\AppServ\Apache\Apache.exe MD5=B9B2AE1820F71F93FEAB64BCAE50332B SIZE=20545
%SystemDiskRoot%\AppServ\Apache\ApacheCore.dll MD5=63E5099A718CB6F39E4D59E78A908056 SIZE=335941
%SystemDiskRoot%\AppServ\Apache\Win9xConHook.dll MD5=70B9883CC9AA478C51981A11C884F3EB SIZE=20560
%SYSDIR%\php4ts.dll [The PHP Group] [PHP Thread Safe] MD5=71275E9C014FE508D72B864E5C1E3E86 SIZE=1343488
%SystemDiskRoot%\AppServ\php\extensions\php_dbase. dll MD5=1DCADF92EF13672801BD7C66F57AC55F SIZE=28672
%SystemDiskRoot%\AppServ\php\extensions\php_exif.d ll MD5=5DC4A5D2AB1FFDBFE527B4D87EC95B8B SIZE=49152
%SystemDiskRoot%\AppServ\php\extensions\php_gd2.dl l MD5=7ACF06DE61CB5C279647A0E94F4F7AC8 SIZE=794624
%SystemDiskRoot%\AppServ\php\extensions\php_iconv. dll MD5=F52775240669EB874F3B84686F74835C SIZE=20480
%SYSDIR%\iconv.dll [Free Software Foundation] [libiconv: character set conversion library] MD5=EA2714C8A9FF6CA9E6556B4F41583991 SIZE=888832
%SystemDiskRoot%\AppServ\php\extensions\php_ming.d ll MD5=9FC470F80C45DFC691D3462182B6FA43 SIZE=188416
%SystemDiskRoot%\AppServ\php\extensions\php_mssql. dll MD5=2FA5FA3C8DB6B0C8061F5C0C6A5F8370 SIZE=40960
%SystemDiskRoot%\AppServ\php\extensions\php_pdf.dl l MD5=C0E407B974FA48763A6C4C94DF8ACDBD SIZE=671744
%SystemDiskRoot%\AppServ\php\extensions\php_pgsql. dll MD5=78760080B05F7D810BD8A2199B9D5528 SIZE=131072
%SystemDiskRoot%\AppServ\php\extensions\php_socket s.dll MD5=581602E5A1C18023B0657EFCC81756D4 SIZE=40960
%SystemDiskRoot%\AppServ\php\extensions\php_zip.dl l MD5=D133EE787107915A0937C13F398ED424 SIZE=40960
%SystemDiskRoot%\appserv\apache\modules\mod_status .so MD5=1C85AD98842E22170177A93F42AC16E6 SIZE=24654
%SystemDiskRoot%\appserv\apache\modules\mod_info.s o MD5=CA84533354B7BA85D84A4C7D83EA0550 SIZE=24652
%SystemDiskRoot%\appserv\apache\modules\mod_rewrit e.so MD5=72E31981C81334A2A0605EEA155C65C0 SIZE=45135
%SystemDiskRoot%\appserv\php\sapi\php4apache.dll MD5=0EA536B2C7D119D182E70CB55F250E15 SIZE=28672
%SystemDiskRoot%\AppServ\php\Zend\lib\ZendExtensio nManager.dll MD5=715FA2F7EE4540F98B3E046CAE4C5FF3 SIZE=20480
%SystemDiskRoot%\AppServ\php\Zend\lib\Optimizer-2.5.7\php-4.3.x\ZendOptimizer.dll MD5=39EBCD1CBF5CDA5CB1BBD4B43493D68E SIZE=245760
%PROGRAMFILES%\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe [Microsoft Corporation] [Microsoft SQL Server] MD5=2DEDD58635AEC83C297981C789927EF4 SIZE=7442493
%PROGRAMFILES%\idt\ecsxpv_5762_010208\wdm\STacSV.e xe [IDT, Inc.] [IDT Audio] MD5=7F0F7EAE6B3234840D08664D5500A864 SIZE=212992
%SYSDIR%\stacapi.dll [IDT, Inc.] [IDT Audio] MD5=49C74820CE726B4E80D7AFD92772E54E SIZE=372736
%PROGRAMFILES%\Microsoft SQL Server\MSSQL\Binn\sqlagent.exe [Microsoft Corporation] [Microsoft SQL Server] MD5=163AD09C3F9257066B78C2333302E488 SIZE=303170
%SYSDIR%\igfxpph.dll [Intel Corporation] [Intel(R) Common User Interface] MD5=66084594A5F1FD4552294D24864BE6B0 SIZE=200704
%SYSDIR%\hccutils.DLL [Intel Corporation] [Intel(R) Common User Interface] MD5=EFAA3EEF1FA03591405032703FB097EE SIZE=102400
%SYSDIR%\igfxres.dll [Intel Corporation] [Intel(R) Common User Interface] MD5=B43BC5F84D35B612D60B1A4296892EE1 SIZE=172032
%SYSDIR%\igfxress.dll [Intel Corporation] [Intel(R) Common User Interface] MD5=BBF918F9587CF152274CB773BDCB7A43 SIZE=3293184
%SYSDIR%\igfxsrvc.dll [Intel Corporation] [Intel(R) Common User Interface] MD5=CF2FE224AA4D7A3F6F797E6C4D09335A SIZE=47616
%PROGRAMFILES%\WinRAR\rarext.dll [Alexander Roshal] [WinRAR] MD5=F11FE030158F8EF14A56A3EA9E9BD47D SIZE=132608
%PROGRAMFILES%\TechSmith\Camtasia Studio 5\CamrecShellExt.dll [TechSmith Corporation] [Camtasia Studio] MD5=BA20F6F64A26B638E1F3ACEA585FB05D SIZE=83288
%SYSDIR%\igfxsrvc.exe [Intel Corporation] [Intel(R) Common User Interface] MD5=827704FDF484DF4E8065C5CA08406F5B SIZE=245760
%PROGRAMFILES%\IDT\WDM\sttray.exe [IDT, Inc.] [IDT Audio] MD5=75A63C3D9142774726489ABA3346AC34 SIZE=413696
%PROGRAMFILES%\IDT\WDM\STLang.dll [IDT, Inc.] [IDT Audio] MD5=C668C359EBF62C52E4BBB6622AE118BE SIZE=2129920
%PROGRAMFILES%\MSN Messenger\MSIMG32.dll [Patchou] [Messenger Plus! Live] MD5=24912259FCF7EAF6CB91DEE8DE948477 SIZE=59728
%PROGRAMFILES%\Messenger Plus! Live\MsgPlusLive.dll [Patchou] [Messenger Plus! Live] MD5=697174DEC7C7B8C7E9F236E3BC46F286 SIZE=3594576
%PROGRAMFILES%\Messenger Plus! Live\Detoured.dll MD5=6256684495C499B22DCDBA266E4F2494 SIZE=4096
%PROGRAMFILES%\Messenger Plus! Live\MsgPlusLiveRes.dll [Patchou] [Messenger Plus! Live] MD5=CC2A3C42820D1FC70ED31E3590293C61 SIZE=1840976
%PROGRAMFILES%\Messenger Plus! Live\libsndfile.dll MD5=00742B11F1492D15A0A8FF25E36AB9BE SIZE=370688
%PROGRAMFILES%\Messenger Plus! Live\lame_enc.dll MD5=75430D2F8B2E204814247D62D9445CE4 SIZE=390656
%SYSDIR%\ZS211Prp.Ax [ZSMC] MD5=A93A9F0540BC0575D3FD40674F60195B SIZE=274432
%SYSDIR%\Macromed\Flash\Flash10b.ocx [Adobe Systems, Inc.] [Shockwave Flash] MD5=8AFC17155ED5AB60B7C52D7F553D579C SIZE=3866528
%PROGRAMFILES%\Free Download Manager\fum\fumcore.dll MD5=7D2D43F9E80C27E41EE4607652152554 SIZE=401408
%PROGRAMFILES%\Puxa Rápido\IEBHO.DLL
deskpan.dll
%SystemDiskRoot%\ARQUIV~1\AIMP2\System\AIMP_S~1.DL L
%PROGRAMFILES%\Microsoft Office\Office12\ONFILTER.DLL [Microsoft Corporation] [Microsoft Office OneNote] MD5=23CD837C3E94BAF99C0B327C660D1DA6 SIZE=74800
%SystemDiskRoot%\Downloads\CursorChanger.dll
%SYSDIR%\DRIVERS\AegisP.sys [Meetinghouse Data Communications] [AEGIS Client 3.5.3.0] MD5=15E655BAA989444F56787EF558823643 SIZE=21419
%SYSDIR%\svchost.exe -k netsvcs
%SYSDIR%\svchost -k DcomLaunch
%SYSDIR%\svchost.exe -k NetworkService
%SYSDIR%\DRIVERS\igxpmp32.sys [Intel Corporation] [Intel Graphics Accelerator Drivers for Windows NT(R)] MD5=C1C2D6940D6EC2F247B0F3C11E0A18E0 SIZE=5700096
%SYSDIR%\svchost.exe -k LocalService
%SYSDIR%\drivers\oreans32.sys MD5=21DC5B289DCE2D32A32BAAB7BCF29A6A SIZE=33824
%SYSDIR%\svchost -k rpcss
%SYSDIR%\DRIVERS\RT2500.sys [Ralink Technology Inc.] [RT2500 802.11g Wireless Adapters] MD5=AE1E626F00180BFB3CA5A81FFFC65332 SIZE=236800
%SYSDIR%\drivers\sthda.sys [IDT, Inc.] [IDT Audio] MD5=B2331AA1955C0D66EFCB7DDBCD32A2BC SIZE=1270872
%SYSDIR%\svchost.exe -k imgsvc
%SYSDIR%\drivers\vvftav211.sys [Vimicro Corporation] [Filter 303] MD5=AF0850CFD99E9E5E142537CD601BCB72 SIZE=480128
%SYSDIR%\Drivers\wg4n.sys [Sygate Technologies, Inc.] [SyberGen WGXN] MD5=266AA247C92F5D202A9CC633142CA425 SIZE=14240
%SYSDIR%\Drivers\wg5n.sys [Sygate Technologies, Inc.] [SyberGen WGXN] MD5=C2A06A1673391203C023DE8BC60927BC SIZE=14240
%SYSDIR%\Drivers\wg6n.sys [Sygate Technologies, Inc.] [SyberGen WGXN] MD5=2E94E4EF8D985BE291CB4573C5DFCA35 SIZE=14240
%SYSDIR%\Drivers\ZS211.sys [ZSMC.Corporation] MD5=17EE5FA37C15EDAE826A7CFAE227BC0B SIZE=1537024
%SYSDIR%\drivers\sp_rsdrv2.sys [Crawler.com] [Spyware Terminator] MD5=8831252BCF05FCFB5ABD116A22E552D8 SIZE=142592

End of Report

Processo de Remoção:

A Preparar Estruturas
A Criar Ponto de Restauro do Sistema
Remover Trojan.Lineage.INT
Ficheiro Apagado: C:\Documents and Settings\User\Configurações locais\Temp\E_4\krnln.fnr
Remover Trojan.Agent2.cdb
Ficheiro Apagado: C:\WINDOWS\system32\scrnrdr.exe
Remover AnalogX PacketMon
Registo Apagado : HKCU\Software\AnalogX\Installer
Remover Trojan.Downloader.Dadobra.bru
Ficheiro Apagado: c:\WINDOWS\system32\Tools\Regexe.exe
Remover Affiliate tracking cookie
Ficheiro Apagado: C:\Documents and Settings\User\cookies\user@advertising[2].txt
Ficheiro Apagado: C:\Documents and Settings\User\cookies\user@atdmt[2].txt
Ficheiro Apagado: C:\Documents and Settings\User\cookies\[email protected][1].txt
Ficheiro Apagado: C:\Documents and Settings\User\cookies\[email protected][1].txt
Ficheiro Apagado: C:\Documents and Settings\User\cookies\user@crazysexvideos[1].txt
Ficheiro Apagado: C:\Documents and Settings\User\cookies\user@doubleclick[1].txt
Ficheiro Apagado: C:\Documents and Settings\User\cookies\user@fastclick[1].txt
Ficheiro Apagado: C:\Documents and Settings\User\cookies\user@grannysextube[2].txt
Ficheiro Apagado: C:\Documents and Settings\User\cookies\user@livesexlist[2].txt
Ficheiro Apagado: C:\Documents and Settings\User\cookies\user@livesex[2].txt
Ficheiro Apagado: C:\Documents and Settings\User\cookies\user@pornhub[1].txt
Ficheiro Apagado: C:\Documents and Settings\User\cookies\user@serving-sys[1].txt
Ficheiro Apagado: C:\Documents and Settings\User\cookies\user@sextracker[1].txt
Ficheiro Apagado: C:\Documents and Settings\User\cookies\user@statcounter[2].txt
Ficheiro Apagado: C:\Documents and Settings\User\cookies\user@tribalfusion[1].txt
Ficheiro Apagado: C:\Documents and Settings\User\cookies\[email protected][1].txt
Ficheiro Apagado: C:\Documents and Settings\User\cookies\[email protected][1].txt
Ficheiro Apagado: C:\Documents and Settings\User\cookies\[email protected][1].txt
Remover AdTool.MyWebSearch.bm
Ficheiro Apagado: c:\Documents and Settings\User\Configurações locais\Temp\NERO13364\Toolbar.exe
Remover RiskTool.Reboot.g
Ficheiro Apagado: c:\WINDOWS\pss\Reboot.exeCommon Startup
Remover RiskTool.Reboot.j
Ficheiro Apagado: c:\WINDOWS\system32\Tools\Restart.exe
A Fechar Ponto de Restauro do Sistema
Terminado

Slet

31-05-2009, 10:54 AM

Oque é isso posso considerar com spam? e te dar ban?

CCV_Blackout

31-05-2009, 01:08 PM

por que oque e isso ?
to pergutando se meu pc aprensenta algum spyware
esse o log do windows apenas mostrei pra alguem que
intende de logs de spyware pra ver se tem ou nao..

CCV_Koston

31-05-2009, 01:11 PM

Oque é isso posso considerar com spam? e te dar ban?
Fumo slet OAkmdsodskaoadsksadosaoka

Calma ae strik se puder faça um scan com o HijackThis fica mais faciu rs, mas vou analizar este ae

Pelo o que eu vi neste strik soh achei esta entrada que pode estrar infectada

%PROGRAMFILES%\Puxa Rápido\IEBHO.DLL

Verifica esta Dll ae ;D

CCV_Blackout

31-05-2009, 02:31 PM

blz.. vlw ;d

-------------------------

ta ae o log dele ;d

ogfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:30:Strik, on 31/5/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe
C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe
C:\AppServ\Apache\Apache.exe
C:\Arquivos de programas\Java\jre6\bin\jqs.exe
C:\ARQUIV~1\MICROS~3\MSSQL\binn\sqlservr.exe
C:\AppServ\Apache\Apache.exe
C:\WINDOWS\Explorer.EXE
C:\Arquivos de programas\Spyware Terminator\sp_rsser.exe
c:\arquivos de programas\idt\ecsxpv_5762_010208\wdm\STacSV.exe
C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\svchost.exe
C:\Arquivos de programas\Spyware Terminator\SpywareTerminatorShield.exe
C:\WINDOWS\system32\ctfmon.exe
C:\ARQUIV~1\MICROS~3\MSSQL\binn\sqlagent.exe
C:\Arquivos de programas\RocketDock\RocketDock.exe
C:\Arquivos de programas\MSN Messenger\usnsvc.exe
C:\Arquivos de programas\MSN Messenger\msnmsgr.exe
C:\Arquivos de programas\Windows Media Player\wmplayer.exe
C:\Arquivos de programas\Mozilla Firefox\firefox.exe
C:\ARQUIV~1\Crawler\Toolbar\CToolbar.exe
C:\ARQUIV~1\FREEDO~1\fdm.exe
C:\WINDOWS\explorer.exe
C:\Downloads\Software\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60341
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\ARQUIV~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\ARQUIV~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: (no name) - {6EF05952-B48D-4944-AA91-57A6A1A48EF8} - C:\Arquivos de programas\Puxa Rápido\IEBHO.DLL (file missing)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\ARQUIV~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Arquivos de programas\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.d ll
O3 - Toolbar: Barra de Ferramentas &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\ARQUIV~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [avgnt] "C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Arquivos de programas\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Arquivos de programas\RocketDock\RocketDock.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Baixar com o Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dllink.htm
O8 - Extra context menu item: Baixar tudo com o Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlall.htm
O8 - Extra context menu item: Baixar vídeo com o Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: Download selecionado pelo Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlselected.htm
O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1215185474843
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A332227B-22BA-4A55-99EB-06DA41838DF7}: NameServer = 201.10.128.2,201.10.120.3
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\ARQUIV~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\ARQUIV~1\Crawler\Toolbar\ctbr.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apache - Unknown owner - C:\AppServ\Apache\Apache.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe
O23 - Service: MySQL - Unknown owner - C:\AppServ\mysql\bin\mysqld-nt.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Arquivos de programas\Spyware Terminator\sp_rsser.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - c:\arquivos de programas\idt\ecsxpv_5762_010208\wdm\STacSV.exe

--
End of file - 8083 bytes

CCV_Koston

31-05-2009, 03:16 PM

Então strik agora achei estes

C:\ARQUIV~1\FREEDO~1\fdm.exe

Passa o anti virus para ter certeza nessa

C:\ARQUIV~1\Crawler\Toolbar\CToolbar.exe

Se vc n usa estas toolbar fica esperto que elas instalam que são uma desgraça pra chama coisa ruim OAKdoskdsao

Do resto não tem mais nada a n ser umas entradas que estão ocupando espaço e podem servir de esconderijo mais eh soh usar um CCleaner por exemplo que fica nos trinks

Qualquer coisa eh soh falar que a gente ajuda ;)

CCV_Blackout

31-05-2009, 03:24 PM

rilex vlw ;d

Dark_SkuLL

31-05-2009, 03:55 PM

FDM naum eh virus...

Eh o Free Download Manager...

CCV_Koston

31-05-2009, 03:58 PM

Sim porem virus as vezes podem infectar os exes

Slet

31-05-2009, 05:16 PM

hum... intaum blz mas ficaria mais simples se vc colocasse isso

pessoal meu pc apareceu esse log será um virus???
Como iamos adivinhar o q vc queria?
abçs =D
Thanks koston por ajudar ele

CCV_Blackout

31-05-2009, 07:00 PM

apareceu esse log ? fumo man ?
e o seguinte mano se fumo
oia eu passei o ant-virus e deu virus
dai me falaram que o ant que eu uso detecta virus no windows tudo bem..
usei o HijackThis para fazer hum log e postar aki pra quem sabe analizar logs
do windows..tem nada ver com meu pc mostrar esse log..

Slet

01-06-2009, 12:31 PM

Caraio vc nuam intendeu eu falei pra vc descrever no tópico o que vc qr apresentando esse log.
Naum foi fumo foi uma dica, pq sem nada assim fica parecendo spam.

abçs