fbeebruno
Power Member
Boas
Ando com uns pequenos problemas!!! andam sempre a aparecer Trojans, o Trojan.Win32.Obfuscated.kp é o mais chato é o que me aparece mais vezes bem como aparece tb novas janelas no internet sem eu fazer nada.
Antes tinha o NOD32 quando esta bicharada começou m a chatear, mudei para o Kaspersky Internet Security 7.0, consegui eliminar alguns, através de pesquisa, mas estes em baixo não consigo elimar!!
Se alguém me puder ajudar...
Detected by Kaspersky internet security 7.0:
deleted: Trojan program Trojan-Downloader.Win32.ConHook.hl File: C:\System Volume Information\_restore{C70A4D48-5A7F-4A4A-8BFB-45CD51C3304D}\RP248\A0089666.dll//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-Downloader.Win32.ConHook.hl File: C:\System Volume Information\_restore{C70A4D48-5A7F-4A4A-8BFB-45CD51C3304D}\RP248\A0089667.dll//PE_Patch.UPX//UPX
detected: Trojan program Trojan-Downloader.Win32.ConHook.hl URL: http://82.98.235.78/lg/mosx1024.dll?uid=EC8852088A4011DC932F150021EFFFFF&guid=A454663FC7F344419D99CC2E2F97918A//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-Downloader.Win32.ConHook.hl File: C:\System Volume Information\_restore{C70A4D48-5A7F-4A4A-8BFB-45CD51C3304D}\RP248\A0089668.dll//PE_Patch.UPX//UPX
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\8456OFUJ\pochki20071106[1]
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\WINDOWS\SYSTEM32\PFRFRSEE.EXE
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\WINDOWS\SYSTEM32\LIHGFELV.EXE
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\WINDOWS\SYSTEM32\TAVCJPDO.EXE
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\WINDOWS\SYSTEM32\XICTLYYF.EXE
deleted: Trojan program Trojan-Downloader.Win32.ConHook.hl File: C:\System Volume Information\_restore{C70A4D48-5A7F-4A4A-8BFB-45CD51C3304D}\RP248\A0089669.dll//PE_Patch.UPX//UPX
deleted: Trojan program Trojan.Win32.BHO.rg File: C:\System Volume Information\_restore{C70A4D48-5A7F-4A4A-8BFB-45CD51C3304D}\RP248\A0089670.dll
deleted: virus Worm.Win32.AutoRun.ao File: H:\Knight.exe
deleted: Trojan program Backdoor.Win32.Rbot.eeq File: C:\System Volume Information\_restore{C70A4D48-5A7F-4A4A-8BFB-45CD51C3304D}\RP248\A0089674.exe
deleted: virus Worm.Win32.AutoRun.ao File: J:\Knight.exe
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\System Volume Information\_restore{C70A4D48-5A7F-4A4A-8BFB-45CD51C3304D}\RP253\A0091154.exe
detected: riskware Hidden data sending Running process: C:\Programas\Internet Explorer\IEXPLORE.EXE
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\System Volume Information\_restore{C70A4D48-5A7F-4A4A-8BFB-45CD51C3304D}\RP253\A0091175.exe
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\System Volume Information\_restore{C70A4D48-5A7F-4A4A-8BFB-45CD51C3304D}\RP253\A0091176.exe
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\System Volume Information\_restore{C70A4D48-5A7F-4A4A-8BFB-45CD51C3304D}\RP253\A0091177.exe
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\YZWJQ1L4\pochki20071106[1]
detected: Trojan program Trojan.Win32.Obfuscated.kp URL: http://82.98.235.78/netob/pochki20071106.exe?uid=EC8852088A4011DC932F150021EFFFFF&guid=A454663FC7F344419D99CC2E2F97918A
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\71X3WE4Y\pochki20071106[1]
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\KLQC7Y4Z\pochki20071106[1]
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\7WQH9H1V\pochki20071106[1]
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.aps File: C:\WINDOWS\system32\lybvvvov.dll
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\WINDOWS\system32\tynqciuj.exe
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\XU35GTC2\pochki20071106[1]
deleted: Trojan program Trojan.Win32.BHO.rf File: C:\System Volume Information\_restore{C70A4D48-5A7F-4A4A-8BFB-45CD51C3304D}\RP217\A0082226.dll
deleted: adware not-a-virus:AdWare.Win32.SecToolBar.k File: C:\System Volume Information\_restore{C70A4D48-5A7F-4A4A-8BFB-45CD51C3304D}\RP246\A0087477.dll
deleted: adware not-a-virus:AdWare.Win32.SecToolBar.k File: C:\System Volume Information\_restore{C70A4D48-5A7F-4A4A-8BFB-45CD51C3304D}\RP246\A0087483.dll
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\W1TFWF63\pochki20071106[1]
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\4G01UZM9\pochki20071106[1]
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.aps File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\7WQH9H1V\hctp[1]
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\99NHFQVI\pochki20071106[1]
deleted: adware not-a-virus:AdWare.Win32.SecToolBar.k File: C:\WINDOWS\system32\ftevkybr.dll
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\WINDOWS\system32\whuhftwq.exe
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\WINDOWS\system32\yxvtgecb.exe
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\82AXIRP7\pochki20071106[1]
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\C83AXZ23\pochki20071106[1]
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\7KMOQ4L0\pochki20071106[1]
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\LI1P18XV\pochki20071106[1]
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\597QAJO6\pochki20071106[1]
detected: riskware Hidden data sending Running process: C:\Programas\Internet Explorer\iexplore.exe
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\WINDOWS\SYSTEM32\JVQWGBBI.EXE
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 18:25:05, on 22-11-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programas\Intel\Wireless\Bin\EvtEng.exe
C:\Programas\Intel\Wireless\Bin\S24EvMon.exe
C:\Programas\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programas\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Programas\Ficheiros comuns\LightScribe\LSSrvc.exe
C:\Programas\Ficheiros comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\Programas\Intel\Wireless\Bin\OProtSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Programas\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Programas\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Programas\ASUS\Wireless Console\wcourier.exe
C:\Programas\ASUS\Power4 Gear\BatteryLife.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\Programas\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programas\Messenger\msmsgs.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
H:\PhoneConnectorVMC.exe
H:\vmc.exe
C:\Programas\MSN Messenger\msnmsgr.exe
C:\Programas\MSN Messenger\usnsvc.exe
C:\Programas\Mozilla Firefox\firefox.exe
C:\Programas\Internet Explorer\iexplore.exe
C:\Documents and Settings\Proprietário\Ambiente de trabalho\HiJackThis_v2.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.clix.pt/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pt/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.clix.pt/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hiperligações
O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Ficheiros comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: (no name) - {32F442EB-FF2D-41BC-9C27-E1F4FBEA84BF} - C:\WINDOWS\system32\ssqpp.dll
O2 - BHO: {e29be512-1650-e6ba-05b4-44ff82141463} - {36414128-ff44-4b50-ab6e-0561215eb92e} - C:\WINDOWS\system32\vjfcbppt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programas\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programas\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programas\Ficheiros comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Wireless Console] C:\Programas\ASUS\Wireless Console\wcourier.exe
O4 - HKLM\..\Run: [Power_Gear] C:\Programas\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programas\Ficheiros comuns\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVP] "C:\Programas\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [3c948802] rundll32.exe "C:\WINDOWS\system32\cpfcowyu.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programas\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIÇO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Serviço de rede')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Add to Anti-Banner - C:\Programas\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programas\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programas\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programas\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?2154614545625
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5EDF113B-F293-436C-96DA-B4E39BF1638B}: NameServer = 80.85.96.131 80.85.97.70
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Daemon da cache de categorias dos componentes - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programas\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programas\Ficheiros comuns\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Programas\Ficheiros comuns\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Programas\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: EvtEng - Intel Corporation - C:\Programas\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programas\Ficheiros comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programas\Ficheiros comuns\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Programas\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: OwnershipProtocol - Intel Corporation - C:\Programas\Intel\Wireless\Bin\OProtSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Programas\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Programas\Intel\Wireless\Bin\S24EvMon.exe
Ando com uns pequenos problemas!!! andam sempre a aparecer Trojans, o Trojan.Win32.Obfuscated.kp é o mais chato é o que me aparece mais vezes bem como aparece tb novas janelas no internet sem eu fazer nada.
Antes tinha o NOD32 quando esta bicharada começou m a chatear, mudei para o Kaspersky Internet Security 7.0, consegui eliminar alguns, através de pesquisa, mas estes em baixo não consigo elimar!!
Se alguém me puder ajudar...
Detected by Kaspersky internet security 7.0:
deleted: Trojan program Trojan-Downloader.Win32.ConHook.hl File: C:\System Volume Information\_restore{C70A4D48-5A7F-4A4A-8BFB-45CD51C3304D}\RP248\A0089666.dll//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-Downloader.Win32.ConHook.hl File: C:\System Volume Information\_restore{C70A4D48-5A7F-4A4A-8BFB-45CD51C3304D}\RP248\A0089667.dll//PE_Patch.UPX//UPX
detected: Trojan program Trojan-Downloader.Win32.ConHook.hl URL: http://82.98.235.78/lg/mosx1024.dll?uid=EC8852088A4011DC932F150021EFFFFF&guid=A454663FC7F344419D99CC2E2F97918A//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-Downloader.Win32.ConHook.hl File: C:\System Volume Information\_restore{C70A4D48-5A7F-4A4A-8BFB-45CD51C3304D}\RP248\A0089668.dll//PE_Patch.UPX//UPX
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\8456OFUJ\pochki20071106[1]
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\WINDOWS\SYSTEM32\PFRFRSEE.EXE
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\WINDOWS\SYSTEM32\LIHGFELV.EXE
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\WINDOWS\SYSTEM32\TAVCJPDO.EXE
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\WINDOWS\SYSTEM32\XICTLYYF.EXE
deleted: Trojan program Trojan-Downloader.Win32.ConHook.hl File: C:\System Volume Information\_restore{C70A4D48-5A7F-4A4A-8BFB-45CD51C3304D}\RP248\A0089669.dll//PE_Patch.UPX//UPX
deleted: Trojan program Trojan.Win32.BHO.rg File: C:\System Volume Information\_restore{C70A4D48-5A7F-4A4A-8BFB-45CD51C3304D}\RP248\A0089670.dll
deleted: virus Worm.Win32.AutoRun.ao File: H:\Knight.exe
deleted: Trojan program Backdoor.Win32.Rbot.eeq File: C:\System Volume Information\_restore{C70A4D48-5A7F-4A4A-8BFB-45CD51C3304D}\RP248\A0089674.exe
deleted: virus Worm.Win32.AutoRun.ao File: J:\Knight.exe
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\System Volume Information\_restore{C70A4D48-5A7F-4A4A-8BFB-45CD51C3304D}\RP253\A0091154.exe
detected: riskware Hidden data sending Running process: C:\Programas\Internet Explorer\IEXPLORE.EXE
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\System Volume Information\_restore{C70A4D48-5A7F-4A4A-8BFB-45CD51C3304D}\RP253\A0091175.exe
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\System Volume Information\_restore{C70A4D48-5A7F-4A4A-8BFB-45CD51C3304D}\RP253\A0091176.exe
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\System Volume Information\_restore{C70A4D48-5A7F-4A4A-8BFB-45CD51C3304D}\RP253\A0091177.exe
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\YZWJQ1L4\pochki20071106[1]
detected: Trojan program Trojan.Win32.Obfuscated.kp URL: http://82.98.235.78/netob/pochki20071106.exe?uid=EC8852088A4011DC932F150021EFFFFF&guid=A454663FC7F344419D99CC2E2F97918A
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\71X3WE4Y\pochki20071106[1]
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\KLQC7Y4Z\pochki20071106[1]
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\7WQH9H1V\pochki20071106[1]
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.aps File: C:\WINDOWS\system32\lybvvvov.dll
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\WINDOWS\system32\tynqciuj.exe
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\XU35GTC2\pochki20071106[1]
deleted: Trojan program Trojan.Win32.BHO.rf File: C:\System Volume Information\_restore{C70A4D48-5A7F-4A4A-8BFB-45CD51C3304D}\RP217\A0082226.dll
deleted: adware not-a-virus:AdWare.Win32.SecToolBar.k File: C:\System Volume Information\_restore{C70A4D48-5A7F-4A4A-8BFB-45CD51C3304D}\RP246\A0087477.dll
deleted: adware not-a-virus:AdWare.Win32.SecToolBar.k File: C:\System Volume Information\_restore{C70A4D48-5A7F-4A4A-8BFB-45CD51C3304D}\RP246\A0087483.dll
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\W1TFWF63\pochki20071106[1]
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\4G01UZM9\pochki20071106[1]
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.aps File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\7WQH9H1V\hctp[1]
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\99NHFQVI\pochki20071106[1]
deleted: adware not-a-virus:AdWare.Win32.SecToolBar.k File: C:\WINDOWS\system32\ftevkybr.dll
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\WINDOWS\system32\whuhftwq.exe
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\WINDOWS\system32\yxvtgecb.exe
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\82AXIRP7\pochki20071106[1]
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\C83AXZ23\pochki20071106[1]
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\7KMOQ4L0\pochki20071106[1]
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\LI1P18XV\pochki20071106[1]
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\Documents and Settings\Proprietário\Definições locais\Temporary Internet Files\Content.IE5\597QAJO6\pochki20071106[1]
detected: riskware Hidden data sending Running process: C:\Programas\Internet Explorer\iexplore.exe
deleted: Trojan program Trojan.Win32.Obfuscated.kp File: C:\WINDOWS\SYSTEM32\JVQWGBBI.EXE
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 18:25:05, on 22-11-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programas\Intel\Wireless\Bin\EvtEng.exe
C:\Programas\Intel\Wireless\Bin\S24EvMon.exe
C:\Programas\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programas\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Programas\Ficheiros comuns\LightScribe\LSSrvc.exe
C:\Programas\Ficheiros comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\Programas\Intel\Wireless\Bin\OProtSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Programas\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Programas\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Programas\ASUS\Wireless Console\wcourier.exe
C:\Programas\ASUS\Power4 Gear\BatteryLife.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\Programas\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programas\Messenger\msmsgs.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
H:\PhoneConnectorVMC.exe
H:\vmc.exe
C:\Programas\MSN Messenger\msnmsgr.exe
C:\Programas\MSN Messenger\usnsvc.exe
C:\Programas\Mozilla Firefox\firefox.exe
C:\Programas\Internet Explorer\iexplore.exe
C:\Documents and Settings\Proprietário\Ambiente de trabalho\HiJackThis_v2.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.clix.pt/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pt/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.clix.pt/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hiperligações
O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Ficheiros comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: (no name) - {32F442EB-FF2D-41BC-9C27-E1F4FBEA84BF} - C:\WINDOWS\system32\ssqpp.dll
O2 - BHO: {e29be512-1650-e6ba-05b4-44ff82141463} - {36414128-ff44-4b50-ab6e-0561215eb92e} - C:\WINDOWS\system32\vjfcbppt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programas\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programas\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programas\Ficheiros comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Wireless Console] C:\Programas\ASUS\Wireless Console\wcourier.exe
O4 - HKLM\..\Run: [Power_Gear] C:\Programas\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programas\Ficheiros comuns\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVP] "C:\Programas\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [3c948802] rundll32.exe "C:\WINDOWS\system32\cpfcowyu.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programas\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIÇO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Serviço de rede')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Add to Anti-Banner - C:\Programas\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programas\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programas\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programas\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?2154614545625
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5EDF113B-F293-436C-96DA-B4E39BF1638B}: NameServer = 80.85.96.131 80.85.97.70
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Daemon da cache de categorias dos componentes - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programas\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programas\Ficheiros comuns\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Programas\Ficheiros comuns\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Programas\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: EvtEng - Intel Corporation - C:\Programas\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programas\Ficheiros comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programas\Ficheiros comuns\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Programas\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: OwnershipProtocol - Intel Corporation - C:\Programas\Intel\Wireless\Bin\OProtSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Programas\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Programas\Intel\Wireless\Bin\S24EvMon.exe
