PC FULL of problems!

My PC is filled with trojans, dialers, viruses, and all kinds of malware. When I switch accounts it doesn't work properly and I have to restart my pc. Ewido finds a lot of stuff and deletes it, but everytime I restart my PC they come back! I used some online antiviruses, but not even they were able to delete everything. Things are getting caotic. My Spybot doesn't download the updates anymore. I need HELP!!!

Here's my active scan:

Incident Status Location

Virus:trj/downloader.elt Disinfected Operating system
Dialer:dialer.xd Not disinfected c:\windows\switchagreement.txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Serginho\Cookies\[removed][1].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Serginho\Cookies\[removed][2].txt
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt[.statcounter.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt[.ig.com.br/]
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt[.overture.com/]
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt[statse.webtrendslive.com/]
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt[.adtech.de/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt[.uol.com.br/]
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt[.com.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt[.bs.serving-sys.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt[.terra.com.br/]
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt[.atwola.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt[.advertising.com/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt[.mediaplex.com/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt[.xiti.com/]
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt[de.uol.com.br/]
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt[.go.com/]
Spyware:Cookie/MetriWeb Not disinfected C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt[.metriweb.be/]
Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt[.maxserving.com/]
Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt[.bravenet.com/]
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt[.google.com.br/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt[.realmedia.com/]
Spyware:Cookie/Admotion Not disinfected C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt[admotion.com.ar/]
Dialer:Dialer.ABR Not disinfected C:\Documents and Settings\Serginho\Desktop\backups\backup-20060914-080638-426.inf
Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Sergio\Cookies\sergio@adultfriendfinder[2].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Sergio\Cookies\sergio@atdmt[1].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Sergio\Cookies\[removed][1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Sergio\Cookies\sergio@doubleclick[1].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Sergio\Cookies\[removed][1].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Sergio\Cookies\[removed][1].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Sergio\Cookies\[removed][1].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Sergio\Cookies\[removed][1].txt
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Sergio\Cookies\sergio@xiti[1].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Sergio\Dados de aplicativos\Mozilla\Firefox\Profiles\ifkguw8t.default\cookies.txt[.ig.com.br/]
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Sergio\Dados de aplicativos\Mozilla\Firefox\Profiles\ifkguw8t.default\cookies.txt[.google.com.br/]
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Sergio\Dados de aplicativos\Mozilla\Firefox\Profiles\ifkguw8t.default\cookies.txt[.de.uol.com.br/]
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Sergio\Dados de aplicativos\Mozilla\Firefox\Profiles\ifkguw8t.default\cookies.txt[.uol.com.br/]
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Sergio\Dados de aplicativos\Mozilla\Firefox\Profiles\ifkguw8t.default\cookies.txt[.terra.com.br/]


and my HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 22:27:08, on 23/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Arquivos de programas\NavNT\defwatch.exe
C:\Arquivos de programas\ewido anti-spyware 4.0\guard.exe
C:\Arquivos de programas\NavNT\rtvscan.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Arquivos de programas\iTunes\iTunesHelper.exe
C:\Arquivos de programas\QuickTime\qttask.exe
C:\Arquivos de programas\NavNT\vptray.exe
C:\Arquivos de programas\iPod\bin\iPodService.exe
C:\Arquivos de programas\Java\jre1.5.0_08\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe
C:\Arquivos de programas\Zone Labs\ZoneAlarm\zapro.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Arquivos de programas\QuickTime\qttask.exe
C:\Arquivos de programas\NavNT\vptray.exe
C:\Arquivos de programas\Java\jre1.5.0_08\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\Zone Labs\ZoneAlarm\zapro.exe
C:\Arquivos de programas\SpywareGuard\sgmain.exe
C:\Arquivos de programas\SpywareGuard\sgbhp.exe
C:\WINDOWS\explorer.exe
C:\Arquivos de programas\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Serginho\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.vermelho.org.br/base.asp
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Arquivos de programas\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\WINDOWS\Downloaded Program Files\gbieh.dll
O4 - HKLM\..\Run: [RemoteControl] "C:\Arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Arquivos de programas\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [vptray] C:\Arquivos de programas\NavNT\vptray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpywareGuard.lnk = C:\Arquivos de programas\SpywareGuard\sgmain.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Arquivos de programas\Zone Labs\ZoneAlarm\zapro.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Arquivos de programas\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} (GbpDistObj Class) - https://www14.bancobrasil.com.br/plugin/GbpDist.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8BEDD66A-ACCF-4C9A-B71C-CE8778B28571}: NameServer = 200.149.55.140 200.165.132.147
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\Arquivos de programas\NavNT\defwatch.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Arquivos de programas\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Arquivos de programas\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Arquivos de programas\NavNT\rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe


Thanks for the much needed help!

Hey LD! Thank you very much for helping me. I hope you can clean up my PC.
Here's the ComboFix log:

Serginho - 06-11-01 23:29:22,07 Service Pack 2
ComboFix 06.10.19 - Running from: "C:\Documents and Settings\Serginho\Desktop"

((((((((((((((((((((((((((((((( Files Created from 2006-10-01 to 2006-11-01 ))))))))))))))))))))))))))))))))))


2006-10-25 12:10 816,288 –a—— C:\WINDOWS\system32\drivers\avg7core.sys
2006-10-25 12:10 4,960 –a—— C:\WINDOWS\system32\drivers\avgtdi.sys
2006-10-25 12:10 4,224 –a—— C:\WINDOWS\system32\drivers\avg7rsw.sys
2006-10-25 12:10 3,968 –a—— C:\WINDOWS\system32\drivers\avgclean.sys
2006-10-25 12:10 28,416 –a—— C:\WINDOWS\system32\drivers\avg7rsxp.sys
2006-10-19 20:22 221,184 –a—— C:\WINDOWS\system32\wmpns.dll
2006-10-10 23:06 26,496 –a—— C:\WINDOWS\system32\drivers\USBSTOR.SYS


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-11-01 23:19 ——– d——– C:\Arquivos de programas\eMule
2006-11-01 22:55 ——– d——– C:\Arquivos de programas\Mozilla Firefox
2006-11-01 08:00 ——– d——– C:\Documents and Settings\Serginho\Dados de aplicativos\AVG7
2006-10-25 12:09 ——– d—s—- C:\Documents and Settings\Serginho\Dados de aplicativos\Microsoft
2006-10-23 09:14 ——– d——– C:\Arquivos de programas\a-squared Free
2006-10-23 05:48 ——– d——– C:\Arquivos de programas\SpywareGuard
2006-10-23 05:46 ——– d——– C:\Arquivos de programas\ewido anti-spyware 4.0
2006-10-12 23:05 ——– d——– C:\Arquivos de programas\WinZip
2006-10-12 23:04 ——– d——– C:\Arquivos de programas\QuickTime
2006-10-12 23:04 ——– d——– C:\Arquivos de programas\NavNT
2006-10-12 23:03 ——– d——– C:\Arquivos de programas\MSN Messenger
2006-10-12 22:59 ——– d——– C:\Arquivos de programas\iTunes
2006-10-12 22:59 ——– d——– C:\Arquivos de programas\Internet Explorer
2006-10-06 22:01 ——– d——– C:\Arquivos de programas\WMP
2006-09-15 09:47 ——– d——– C:\Arquivos de programas\Java
2006-09-15 09:42 ——– d——– C:\Arquivos de programas\Arquivos comuns\Java
2006-09-15 09:42 ——– d——– C:\Arquivos de programas\Arquivos comuns


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"RemoteControl"="\"C:\\Arquivos de programas\\CyberLink DVD Solution\\PowerDVD\\PDVDServ.exe\""
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"iTunesHelper"="\"C:\\Arquivos de programas\\iTunes\\iTunesHelper.exe\""
"QuickTime Task"="\"C:\\Arquivos de programas\\QuickTime\\qttask.exe\" -atboottime"
"vptray"="C:\\Arquivos de programas\\NavNT\\vptray.exe"
"SunJavaUpdateSched"="\"C:\\Arquivos de programas\\Java\\jre1.5.0_08\\bin\\jusched.exe\""
"AVG7_CC"="C:\\ARQUIV~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Minha página inicial atual"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,de,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"
"AVG7_Run"="C:\\ARQUIV~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"
"AVG7_Run"="C:\\ARQUIV~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-carregador Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Daemon de cache de categorias de componente"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0"
"{E37CB5F0-51F5-4395-A808-5FA49E399F83}"="GbPlugin ShlObj"
"{81559C35-8464-49F7-BB0E-07A383BEF910}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Completion time: 06-11-01 23:29:51.00
C:\ComboFix.txt … 06-11-01 23:29
C:\ComboFix2.txt … 06-11-01 23:28
C:\ComboFix3.txt … 06-11-01 23:21



And here's my HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 23:31:51, on 1/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Arquivos de programas\NavNT\defwatch.exe
C:\Arquivos de programas\ewido anti-spyware 4.0\guard.exe
C:\Arquivos de programas\NavNT\rtvscan.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Arquivos de programas\iTunes\iTunesHelper.exe
C:\Arquivos de programas\QuickTime\qttask.exe
C:\Arquivos de programas\NavNT\vptray.exe
C:\Arquivos de programas\Java\jre1.5.0_08\bin\jusched.exe
C:\Arquivos de programas\iPod\bin\iPodService.exe
C:\ARQUIV~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\Zone Labs\ZoneAlarm\zapro.exe
C:\WINDOWS\system32\devldr32.exe
C:\Arquivos de programas\SpywareGuard\sgmain.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Arquivos de programas\SpywareGuard\sgbhp.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Serginho\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.vermelho.org.br/base.asp
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Arquivos de programas\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\WINDOWS\Downloaded Program Files\gbieh.dll
O4 - HKLM\..\Run: [RemoteControl] "C:\Arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Arquivos de programas\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [vptray] C:\Arquivos de programas\NavNT\vptray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\ARQUIV~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpywareGuard.lnk = C:\Arquivos de programas\SpywareGuard\sgmain.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Arquivos de programas\Zone Labs\ZoneAlarm\zapro.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Arquivos de programas\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} (GbpDistObj Class) - https://www14.bancobrasil.com.br/plugin/GbpDist.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Arquivos de programas\NavNT\defwatch.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Arquivos de programas\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Arquivos de programas\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Arquivos de programas\NavNT\rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Dank! Merci! Gracias! Obrigado! Thank you!!!

HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 12:09:41, on 2/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Arquivos de programas\NavNT\defwatch.exe
C:\Arquivos de programas\ewido anti-spyware 4.0\guard.exe
C:\Arquivos de programas\NavNT\rtvscan.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Arquivos de programas\iTunes\iTunesHelper.exe
C:\Arquivos de programas\QuickTime\qttask.exe
C:\Arquivos de programas\NavNT\vptray.exe
C:\Arquivos de programas\Java\jre1.5.0_08\bin\jusched.exe
C:\Arquivos de programas\iPod\bin\iPodService.exe
C:\ARQUIV~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\Zone Labs\ZoneAlarm\zapro.exe
C:\WINDOWS\system32\devldr32.exe
C:\Arquivos de programas\SpywareGuard\sgmain.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Arquivos de programas\SpywareGuard\sgbhp.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Serginho\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.vermelho.org.br/base.asp
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Arquivos de programas\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\WINDOWS\Downloaded Program Files\gbieh.dll
O4 - HKLM\..\Run: [RemoteControl] "C:\Arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Arquivos de programas\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [vptray] C:\Arquivos de programas\NavNT\vptray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\ARQUIV~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpywareGuard.lnk = C:\Arquivos de programas\SpywareGuard\sgmain.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Arquivos de programas\Zone Labs\ZoneAlarm\zapro.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Arquivos de programas\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} (GbpDistObj Class) - https://www14.bancobrasil.com.br/plugin/GbpDist.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Arquivos de programas\NavNT\defwatch.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Arquivos de programas\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Arquivos de programas\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Arquivos de programas\NavNT\rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

oh! And now there's something new happening. When I reboot my PC this message shows "drwtsn32.exe" and the PC freezes. I have to ctrl+alt+del and go back to the profile screen.

Thnx LDTate. My monitor burned and I had to fiz it. It took me a while to do so. Thnx again for your patience and for helping once more and I'm sorry for disapearing. Here's the avg anti-spyware report:

AVG Anti-Spyware - Relatório de verificação
———————————————————

+ Criação: 16:28:07 11/11/2006

+ Resultado da verificação:



C:\System Volume Information\_restore{55EA248D-890A-4C18-9FF8-CF3AF73D8FBA}\RP75\A0010168.dll -> Hijacker.Agent.ac : Nenhuma ação executada.
C:\System Volume Information\_restore{55EA248D-890A-4C18-9FF8-CF3AF73D8FBA}\RP75\A0010170.exe -> Logger.Agent.od : Nenhuma ação executada.
:mozilla.115:C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt -> TrackingCookie.2o7 : Nenhuma ação executada.
:mozilla.215:C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt -> TrackingCookie.2o7 : Nenhuma ação executada.
C:\Documents and Settings\Sergio\Cookies\sergio@adbrite[2].txt -> TrackingCookie.Adbrite : Nenhuma ação executada.
:mozilla.220:C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt -> TrackingCookie.Adrevolver : Nenhuma ação executada.
:mozilla.221:C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt -> TrackingCookie.Adrevolver : Nenhuma ação executada.
:mozilla.72:C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt -> TrackingCookie.Adtech : Nenhuma ação executada.
:mozilla.74:C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt -> TrackingCookie.Adtech : Nenhuma ação executada.
:mozilla.120:C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt -> TrackingCookie.Advertising : Nenhuma ação executada.
:mozilla.121:C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt -> TrackingCookie.Advertising : Nenhuma ação executada.
:mozilla.122:C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt -> TrackingCookie.Advertising : Nenhuma ação executada.
:mozilla.79:C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt -> TrackingCookie.Atdmt : Nenhuma ação executada.
C:\Documents and Settings\Sergio\Cookies\sergio@atdmt[2].txt -> TrackingCookie.Atdmt : Nenhuma ação executada.
C:\Documents and Settings\Sergio\Cookies\sergio@casalemedia[1].txt -> TrackingCookie.Casalemedia : Nenhuma ação executada.
:mozilla.133:C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt -> TrackingCookie.Com : Nenhuma ação executada.
:mozilla.55:C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt -> TrackingCookie.Doubleclick : Nenhuma ação executada.
C:\Documents and Settings\Sergio\Cookies\[removed][2].txt -> TrackingCookie.Falkag : Nenhuma ação executada.
:mozilla.218:C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt -> TrackingCookie.Fastclick : Nenhuma ação executada.
:mozilla.204:C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt -> TrackingCookie.Hitbox : Nenhuma ação executada.
:mozilla.205:C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt -> TrackingCookie.Hitbox : Nenhuma ação executada.
:mozilla.206:C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt -> TrackingCookie.Hitbox : Nenhuma ação executada.
:mozilla.96:C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt -> TrackingCookie.Mediaplex : Nenhuma ação executada.
:mozilla.200:C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt -> TrackingCookie.Overture : Nenhuma ação executada.
C:\Documents and Settings\Sergio\Cookies\sergio@revenue[1].txt -> TrackingCookie.Revenue : Nenhuma ação executada.
C:\Documents and Settings\Sergio\Cookies\sergio@sexlist[2].txt -> TrackingCookie.Sexlist : Nenhuma ação executada.
:mozilla.222:C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt -> TrackingCookie.Statcounter : Nenhuma ação executada.
:mozilla.116:C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt -> TrackingCookie.Tacoda : Nenhuma ação executada.
:mozilla.117:C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt -> TrackingCookie.Tacoda : Nenhuma ação executada.
:mozilla.118:C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt -> TrackingCookie.Tacoda : Nenhuma ação executada.
:mozilla.119:C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt -> TrackingCookie.Tacoda : Nenhuma ação executada.
:mozilla.36:C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt -> TrackingCookie.Tribalfusion : Nenhuma ação executada.
:mozilla.223:C:\Documents and Settings\Serginho\Dados de aplicativos\Mozilla\Firefox\Profiles\zlkr8obo.default\cookies.txt -> TrackingCookie.Yieldmanager : Nenhuma ação executada.
C:\Documents and Settings\Sergio\Cookies\[removed][2].txt -> TrackingCookie.Yieldmanager : Nenhuma ação executada.
C:\System Volume Information\_restore{55EA248D-890A-4C18-9FF8-CF3AF73D8FBA}\RP71\A0007151.exe -> Trojan.LipGame.af : Nenhuma ação executada.
C:\System Volume Information\_restore{55EA248D-890A-4C18-9FF8-CF3AF73D8FBA}\RP72\A0007199.exe -> Trojan.LipGame.af : Nenhuma ação executada.
C:\System Volume Information\_restore{55EA248D-890A-4C18-9FF8-CF3AF73D8FBA}\RP74\A0008214.exe -> Trojan.LipGame.ah : Nenhuma ação executada.
C:\System Volume Information\_restore{55EA248D-890A-4C18-9FF8-CF3AF73D8FBA}\RP75\A0010169.exe -> Trojan.LipGame.ah : Nenhuma ação executada.


::Fim do relatório

What is weird is that i changed the "Recommended actions" to Quarantine, but when I rebooted my pc in safemode and did the scan, when it was done the "recommended action" was to delete everything found. I manually switched to quarantine, but it only changed the trojans. The cookies stayed the same, to be deleted.
And now I see this "nenhuma ação executada" at the end of everything. It means, "no action taken". I guess everything is still there, huh?

My HighjackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 16:30:09, on 11/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Arquivos de programas\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Documents and Settings\Serginho\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.vermelho.org.br/base.asp
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Arquivos de programas\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\WINDOWS\Downloaded Program Files\gbieh.dll
O4 - HKLM\..\Run: [RemoteControl] "C:\Arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Arquivos de programas\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [vptray] C:\Arquivos de programas\NavNT\vptray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Arquivos de programas\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpywareGuard.lnk = C:\Arquivos de programas\SpywareGuard\sgmain.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Arquivos de programas\Zone Labs\ZoneAlarm\zapro.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Arquivos de programas\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} (GbpDistObj Class) - https://www14.bancobrasil.com.br/plugin/GbpDist.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Arquivos de programas\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Arquivos de programas\NavNT\defwatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Arquivos de programas\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Arquivos de programas\NavNT\rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Hope you can help me!