What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed]Virtumonde

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
the files were submitted.

here's te logs: combofix log were generated before GMER. hijackthis were generated after GMER.


ComboFix 07-08-07.4 - "MARCOS" 2007-08-07 3:32:37.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.464 [GMT -3:00]
Command switches used :: C:\Documents and Settings\Roberto\programas\CFScript.txt


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\Tasks\At10.job
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\Tasks\At15.job
C:\WINDOWS\Tasks\At16.job
C:\WINDOWS\Tasks\At17.job
C:\WINDOWS\Tasks\At18.job
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At20.job
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\Tasks\At23.job
C:\WINDOWS\Tasks\At24.job
C:\WINDOWS\Tasks\At3.job
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\Tasks\At6.job
C:\WINDOWS\Tasks\At8.job
C:\WINDOWS\Tasks\At9.job


((((((((((((((((((((((((( Files Created from 2007-07-07 to 2007-08-07 )))))))))))))))))))))))))))))))


2007-08-06 21:46 d——– C:\spoolerlogs
2007-08-06 13:28 d——– C:\Arquivos de programas\Trend Micro
2007-08-06 12:31 d——– C:\WINDOWS\CSC
2007-08-06 04:09 d——– C:\DOCUME~1\MARCOS\DADOSD~1\Lavasoft
2007-08-06 03:34 9,464 ——— C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-08-06 03:34 9,336 ——— C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-08-06 03:34 43,528 ——— C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-08-06 03:34 129,784 ——— C:\WINDOWS\system32\pxafs.dll
2007-08-05 17:05 d——– C:\WINDOWS\pss
2007-08-05 16:52 d——– C:\DOCUME~1\MARCOS\.housecall6.6
2007-08-04 21:57 d——– C:\VundoFix Backups
2007-08-04 20:35 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-03 20:28 d——– C:\Arquivos de programas\VideoLAN
2007-08-03 20:21 21,764 –a—— C:\WINDOWS\system32\CoreAAC-uninstall.exe
2007-08-03 20:16 d——– C:\DOCUME~1\Marcos_2\DADOSD~1\Media Player Classic
2007-08-03 20:15 d——– C:\Arquivos de programas\XP Codec Pack
2007-08-03 19:42 d——– C:\Arquivos de programas\GSpot
2007-08-03 18:37 d——– C:\Arquivos de programas\ffdshow
2007-08-01 03:19 d——– C:\DOCUME~1\ALLUSE~1\DADOSD~1\Macrovision
2007-08-01 03:18 d——– C:\Arquivos de programas\Arquivos comuns\Macromedia Shared
2007-07-22 12:23 d——– C:\DOCUME~1\Marcos_2\DADOSD~1\.Torrent Swapper
2007-07-22 12:22 d——– C:\Arquivos de programas\Swapper
2007-07-19 16:03 d——– C:\Arquivos de programas\Flash Optimizer
2007-07-19 15:28 d——– C:\Arquivos de programas\Liatro
2007-07-19 15:05 d——– C:\Arquivos de programas\Eltima Software


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-07 03:31 ——— d——– C:\Arquivos de programas\Soulseek
2007-08-06 03:34 ——— d——– C:\Arquivos de programas\Winamp
2007-08-06 00:08 ——— d——– C:\Arquivos de programas\GetRight
2007-08-02 00:18 134 –a—— C:\autoexec.bat
2007-08-01 03:18 ——— d–h—– C:\Arquivos de programas\InstallShield Installation Information
2007-07-22 00:19 ——— d——– C:\Arquivos de programas\GbPlugin
2007-06-26 23:16 292 –a—— C:\mediamp3.dat
2007-06-26 23:12 ——— d——– C:\Arquivos de programas\MP3 Player Utilities 4.05
2007-06-10 20:53 ——— d——– C:\Arquivos de programas\IVT Corporation
2007-06-09 13:05 ——— d——– C:\Arquivos de programas\QuickTime
2007-06-07 16:10 20480 –a—— C:\WINDOWS\system32\ac3config.exe
2007-06-07 00:57 ——— d——– C:\Arquivos de programas\Total Video Converter
2007-05-16 12:13 86528 –a–c— C:\WINDOWS\system32\dllcache\directdb.dll
2007-05-16 12:13 85504 –a–c— C:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-16 12:13 683520 –a–c— C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-05-16 12:13 683520 –a—— C:\WINDOWS\system32\inetcomm.dll
2007-05-16 12:13 510976 –a–c— C:\WINDOWS\system32\dllcache\wab32.dll
2007-05-16 12:13 1314816 –a–c— C:\WINDOWS\system32\dllcache\msoe.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe" [2007-04-20 12:31]
"EPSON Stylus C67 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAL.exe" [2005-01-25 04:00]
"Adobe Photo Downloader"="C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" []
"SunJavaUpdateSched"="C:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"QuickTime Task"="C:\Arquivos de programas\QuickTime\qttask.exe" [2007-06-09 13:01]
"Adobe Reader Speed Launcher"="C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"mmtask"="c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Arquivos de programas\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]

C:\Documents and Settings\MARCOS\Menu Iniciar\Programas\Inicializar\
Scanner Utilities.lnk - C:\WINDOWS\twain_32\Minipa\ms9600c\SCANER32.EXE [2007-05-08 06:00:56]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{E37CB5F0-51F5-4395-A808-5FA49E399008}"= C:\WINDOWS\Downloaded Program Files\gbiehuni.dll [2007-03-06 10:00 222376]
"{E37CB5F0-51F5-4395-A808-5FA49E399003}"= C:\WINDOWS\Downloaded Program Files\gbiehCef.dll [2007-03-07 11:09 219456]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"usnjsvc"=3 (0x3)
"ose"=3 (0x3)
"GbpSv"=2 (0x2)
"SoundMAX Agent Service (default)"=2 (0x2)

R0 BTHidMgr;Bluetooth HID Manager Service;C:\WINDOWS\system32\Drivers\BTHidMgr.sys
R0 gagp30kx;Microsoft Generic AGPv3.0 Filter for K8 Processor Platforms;C:\WINDOWS\system32\DRIVERS\gagp30kx.sys
R2 Av260cn;Av260cn;C:\WINDOWS\system32\drivers\Av260cn.sys
R2 Av260cnb;Av260cnb;C:\WINDOWS\system32\drivers\Av260cnb.sys
R2 Av260cnd;Av260cnd;C:\WINDOWS\system32\drivers\Av260cnd.sys
R2 GbpSv;Gbp Service;C:\Arquivos de programas\GbPlugin\GbpSv.exe
R3 BlueletAudio;Bluetooth Audio Service;C:\WINDOWS\system32\DRIVERS\blueletaudio.sys
R3 BTHidEnum;Bluetooth HID Enumerator;C:\WINDOWS\system32\DRIVERS\vbtenum.sys
R3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\fetnd5.sys
R3 MxlW2k;MxlW2k;C:\WINDOWS\system32\drivers\MxlW2k.sys
R3 ROOTMODEM;Microsoft Legacy Modem Driver;C:\WINDOWS\system32\Drivers\RootMdm.sys
R3 VComm;Virtual Serial port driver;C:\WINDOWS\system32\DRIVERS\VComm.sys
R3 VcommMgr;Bluetooth VComm Manager Service;C:\WINDOWS\system32\Drivers\VcommMgr.sys
S3 BT;Bluetooth PAN Network Adapter;C:\WINDOWS\system32\DRIVERS\btnetdrv.sys
S3 Btcsrusb;Bluetooth USB For Bluetooth Service;C:\WINDOWS\system32\Drivers\btcusb.sys
S3 USB_RNDIS;USB Remote NDIS Network Device Driver;C:\WINDOWS\system32\DRIVERS\usb8023.sys
S4 SoundMAX Agent Service (default);SoundMAX Agent Service;C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe


Contents of the 'Scheduled Tasks' folder
2007-08-07 03:00:00 C:\WINDOWS\Tasks\At1.job
2007-08-04 13:00:30 C:\WINDOWS\Tasks\At11.job
2007-08-04 00:19:17 C:\WINDOWS\Tasks\At12.job
2007-08-04 09:00:31 C:\WINDOWS\Tasks\At7.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-07 03:33:08
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-07 3:33:46
C:\ComboFix-quarantined-files.txt … 2007-08-07 03:33
C:\ComboFix2.txt … 2007-08-07 02:54
C:\ComboFix3.txt … 2007-08-07 00:14

— E O F —



GMER 1.0.13.12551 - http://www.gmer.net
Rootkit scan 2007-08-07 03:50:57
Windows 5.1.2600 Service Pack 2


—- Kernel code sections - GMER 1.0.13 —-

? ComboFix.sys O sistema não pode encontrar o arquivo especificado.
? C:\DOCUME~1\MARCOS\CONFIG~1\Temp\catchme.sys O sistema não pode encontrar o arquivo especificado.
? C:\WINDOWS\system32\Drivers\PROCEXP90.SYS O sistema não pode encontrar o arquivo especificado.

—- User code sections - GMER 1.0.13 —-

.text C:\WINDOWS\system32\winlogon.exe[680] kernel32.dll!FreeLibrary 7C80ABDE 5 Bytes JMP 1002B1B0 C:\WINDOWS\Downloaded Program Files\gbiehCef.dll

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_NAMED_PIPE [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_READ [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_INTERNAL_DEVICE_CONTROL [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_MAILSLOT [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_POWER [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SYSTEM_CONTROL [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CHANGE [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA [F7A86404] avg7rsw.sys

Device \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL [F7A9E85A] avgtdi.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL [F7A9E85A] avgtdi.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL [F7A9E85A] avgtdi.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL [F7A9E85A] avgtdi.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_INTERNAL_DEVICE_CONTROL [F7A9E85A] avgtdi.sys

AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CREATE [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CREATE_NAMED_PIPE [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CLOSE [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_READ [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_WRITE [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_INFORMATION [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_INFORMATION [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_EA [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_EA [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_FLUSH_BUFFERS [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_VOLUME_INFORMATION [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_VOLUME_INFORMATION [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_DIRECTORY_CONTROL [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_FILE_SYSTEM_CONTROL [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CONTROL [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_INTERNAL_DEVICE_CONTROL [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SHUTDOWN [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_LOCK_CONTROL [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CLEANUP [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CREATE_MAILSLOT [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_SECURITY [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_SECURITY [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_POWER [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SYSTEM_CONTROL [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CHANGE [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_QUOTA [F7A86404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_QUOTA [F7A86404] avg7rsw.sys

—- Files - GMER 1.0.13 —-

ADS C:\Documents and Settings\MARCOS\Configurações locais\Dados de aplicativos\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{4618BD89-3960-5B76-D983-272214BB4400}1\10-{4618BD89-3960-5B76-D983-272214BB4400}-v1-{FA88BDC1-0D4D-4CD7-8156-49B66646C331}-v10-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS

—- EOF - GMER 1.0.13 —-



Logfile of HijackThis v1.99.1
Scan saved at 03:52:03, on 7/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Arquivos de programas\GbPlugin\GbpSv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe
C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe
C:\ARQUIV~1\Grisoft\AVG7\avgemc.exe
C:\Arquivos de programas\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Arquivos de programas\internet explorer\iexplore.exe
C:\Documents and Settings\Roberto\programas\Spyware.exe.exe

O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\WINDOWS\Downloaded Program Files\gbiehCef.dll
O2 - BHO: G-Buster Browser Defense Unibanco - {C41A1C0E-EA6C-11D4-B1B8-444553540008} - C:\WINDOWS\Downloaded Program Files\gbiehuni.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [EPSON Stylus C67 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAL.EXE /P23 "EPSON Stylus C67 Series" /O6 "USB001" /M "Stylus C67"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Scanner Utilities.lnk = C:\WINDOWS\twain_32\Minipa\ms9600c\SCANER32.EXE
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399003} (GbPluginObj Class) - https://imagem.caixa.gov.br/cab/GbPluginCef.cab
O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399008} (GbPluginObj Class) - https://clickbanking.unibanco.com.br/GbPlug…GbPluginUni.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgemc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Arquivos de programas\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Gbp Service (GbpSv) - Unknown owner - C:\Arquivos de programas\GbPlugin\GbpSv.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Arquivos de programas\Arquivos comuns\Macromedia Shared\Service\Macromedia Licensing.exe



Thanks for now and always.
Post #18
A. Please delete the following files:

C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\Tasks\At11.job
C:\WINDOWS\Tasks\At12.job
C:\WINDOWS\Tasks\At7.job


B. That appears to clean up your logs. Please use the Internet Explorer browser, and do an online scan with Kaspersky Online Scanner
Click Yes, when prompted to install its ActiveX component.
(Note.. for Internet Explorer 7 users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.)
The program launches and downloads the latest definition files.
  • Once the files are downloaded click on Next
  • Click on Scan Settings and configure as follows:
    • Scan using the following Anti-Virus database:
      • Extended
    • Scan Options:Scan Archives
      Scan Mail Bases
  • Click OK and, under select a target to scan, select My Computer
When the scan is done, in the Scan is completed window (below), any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.
[external image: Posted Image]
[external image: Posted Image]
To obtain the report:
Click on: Save Report As (above - red blinking arrow)
Next, in the Save as prompt, Save in area, select: Desktop
In the File name area, use KScan, or something similar
In Save as type, click the drop arrow and select: Text file [*.txt]
Then, click: Save
Please post the Kaspersky Online Scanner Report in your reply, along with a fresh HijackThis log


C. Also please tell me how your system is now running. If everything is OK, just give me the OK and we will proceed with the final cleanup procedures.

Trevuren
Post #19
My pc in running ok, better than it was before. Until now, no problems.

Here's the Kaspersky and hijackthis logs:

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Wednesday, August 08, 2007 1:40:09 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 8/08/2007
Kaspersky Anti-Virus database records: 376996
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 73805
Number of viruses found: 10
Number of infected objects: 26
Number of suspicious objects: 0
Duration of the scan process: 01:13:31

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Dados de aplicativos\avg7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Cef\bank.gbl.40.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Cef\bank.gbl.41.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Cef\bank.gbl.42.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Cef\bank.gbl.43.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Cef\bank.gbl.44.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Cef\gbieh.gbl.11.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Cef\gbieh.gbl.21.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Cef\gbieh.gbl.3.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Cef\gbieh.gbl.34.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Cef\gbieh.gbl.36.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Cef\gbieh.gbl.37.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Cef\gbieh.gbl.48.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Cef\gbieh.gbl.51.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Cef\gbieh.gbl.52.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Cef\gbieh.gbl.53.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Cef\gbieh.gbl.54.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Cef\gbieh.gbl.58.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Cef\gbieh.gbl.60.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Cef\gbieh.gbl.63.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Cef\gbieh.gbl.70.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Cef\gbieh.mtu Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Cef\spec.gbl.1.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Uni\bank.gbl.40.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Uni\bank.gbl.41.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Uni\bank.gbl.42.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Uni\gbieh.gbl.12.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Uni\gbieh.gbl.15.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Uni\gbieh.gbl.18.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Uni\gbieh.gbl.23.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Uni\gbieh.gbl.26.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Uni\gbieh.gbl.29.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Uni\gbieh.gbl.32.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Uni\gbieh.gbl.35.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Uni\gbieh.gbl.4.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Uni\gbieh.gbl.40.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Uni\gbieh.gbl.45.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Uni\gbieh.gbl.5.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Uni\gbieh.gbl.66.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Uni\gbieh.gbl.69.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Uni\gbieh.gbl.7.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Uni\gbieh.gbl.73.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Uni\gbieh.gbl.74.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Uni\gbieh.gbl.83.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Uni\gbieh.gbl.85.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Uni\gbieh.mtu Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Uni\GbpMid3.gbp Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Uni\gbpsv.exe.upd.B17E5216 Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Uni\Uni.gdt Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin\Uni\Uni.mnn Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft\Dr Watson\user.dmp Object is locked skipped
C:\Documents and Settings\LocalService\Configurações locais\Dados de aplicativos\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Configurações locais\Dados de aplicativos\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Configurações locais\Histórico\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Configurações locais\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\MARCOS\.housecall6.6\Quarantine\revelation.zip.bac_a00312/Revelation.exe Infected: not-a-virus:PSWTool.Win32.SnadBoy.11 skipped
C:\Documents and Settings\MARCOS\.housecall6.6\Quarantine\revelation.zip.bac_a00312 ZIP: infected - 1 skipped
C:\Documents and Settings\MARCOS\.housecall6.6\Quarantine\revelation.zip.bac_a00312 CryptFF.b: infected - 1 skipped
C:\Documents and Settings\MARCOS\Configurações locais\Dados de aplicativos\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\MARCOS\Configurações locais\Dados de aplicativos\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\MARCOS\Configurações locais\Histórico\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\MARCOS\Configurações locais\Histórico\History.IE5\MSHist012007080820070809\index.dat Object is locked skipped
C:\Documents and Settings\MARCOS\Configurações locais\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\MARCOS\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\MARCOS\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\MARCOS\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Configurações locais\Dados de aplicativos\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Configurações locais\Dados de aplicativos\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Roberto\programas\eMule0.48a\Temp\1.part Object is locked skipped
C:\Documents and Settings\Roberto\programas\eMule0.48a\Temp\2.part Object is locked skipped
C:\Documents and Settings\Roberto\programas\eMule0.48a\Temp\3.part Object is locked skipped
C:\Documents and Settings\Roberto\programas\eMule0.48a\Temp\4.part Object is locked skipped
C:\Documents and Settings\Roberto\programas\eMule0.48a\Temp\5.part Object is locked skipped
C:\Documents and Settings\Roberto\programas\eMule0.48a\Temp\6.part Object is locked skipped
C:\Documents and Settings\Roberto\programas\eMule0.48a\Temp\7.part Object is locked skipped
C:\Documents and Settings\Roberto\programas\eMule0.48a\Temp\8.part Object is locked skipped
C:\Documents and Settings\Roberto\programas\eMule0.48a\Temp\9.part Object is locked skipped
C:\Documents and Settings\Roberto\programas\eMule0.48a\Temp11.part Object is locked skipped
C:\Documents and Settings\Roberto\programas\eMule0.48a\Temp12.part Object is locked skipped
C:\Documents and Settings\Roberto\programas\eMule0.48a\Temp13.part Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
F:\MARCOS\Programas\GETRT411.EXE/WISE0023.BIN Infected: not-a-virus:AdWare.Win32.Aureate.a skipped
F:\MARCOS\Programas\GETRT411.EXE/WISE0024.BIN Infected: not-a-virus:AdWare.Win32.Aureate.a skipped
F:\MARCOS\Programas\GETRT411.EXE WiseSFX: infected - 2 skipped
F:\MARCOS\Programas\AGSetup0608.exe/fsg-ag.exe Infected: not-a-virus:AdWare.Win32.Gator.1050 skipped
F:\MARCOS\Programas\AGSetup0608.exe Vise: infected - 1 skipped
F:\MARCOS\Programas\GroksterUpdate151.exe//smallgrokstersetup.exe/WISE0012.BIN/cd_clint.dll Infected: not-a-virus:AdWare.Win32.Cydoor skipped
F:\MARCOS\Programas\GroksterUpdate151.exe//smallgrokstersetup.exe/WISE0012.BIN/cd_htm.dll Infected: not-a-virus:AdWare.Win32.Cydoor skipped
F:\MARCOS\Programas\GroksterUpdate151.exe//smallgrokstersetup.exe/WISE0012.BIN Infected: not-a-virus:AdWare.Win32.Cydoor skipped
F:\MARCOS\Programas\GroksterUpdate151.exe//smallgrokstersetup.exe/WISE0022.BIN Infected: not-a-virus:AdWare.Win32.Cydoor skipped
F:\MARCOS\Programas\GroksterUpdate151.exe//smallgrokstersetup.exe/WISE0023.BIN Infected: not-a-virus:AdWare.Win32.Cydoor skipped
F:\MARCOS\Programas\GroksterUpdate151.exe//smallgrokstersetup.exe Infected: not-a-virus:AdWare.Win32.Cydoor skipped
F:\MARCOS\Programas\GroksterUpdate151.exe CabSFX: infected - 6 skipped
F:\MARCOS\Programas\AGSetup0609.exe/trickler3202_bic_audiogalaxydt.exe Infected: not-a-virus:AdWare.Win32.Gator.3202 skipped
F:\MARCOS\Programas\AGSetup0609.exe/fsg-ag.exe Infected: not-a-virus:AdWare.Win32.Gator.3202 skipped
F:\MARCOS\Programas\AGSetup0609.exe Vise: infected - 2 skipped
F:\MARCOS\Programas\GDiVX1.9.9.5.exe/data0011 Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
F:\MARCOS\Programas\GDiVX1.9.9.5.exe/data0012 Infected: not-a-virus:AdWare.Win32.GigatechSuperBar skipped
F:\MARCOS\Programas\GDiVX1.9.9.5.exe/data0013 Infected: not-a-virus:AdWare.Win32.SaveNow.bx skipped
F:\MARCOS\Programas\GDiVX1.9.9.5.exe NSIS: infected - 3 skipped
F:\MARCOS\Programas\CoreAAC-1.2.0.575rev3.zip/CoreAAC-1.2.0.575-3.exe Infected: Trojan-Downloader.Win32.Zlob.bcl skipped
F:\MARCOS\Programas\CoreAAC-1.2.0.575rev3.zip ZIP: infected - 1 skipped
F:\MARCOS\Programas\CoreAAC-1.2.0.575rev3\CoreAAC-1.2.0.575-3.exe Infected: Trojan-Downloader.Win32.Zlob.bcl skipped
F:\MARCOS\Programas\mirc\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.603 skipped

Scan process completed.





Logfile of HijackThis v1.99.1
Scan saved at 01:41:14, on 8/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Arquivos de programas\GbPlugin\GbpSv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe
C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe
C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe
C:\ARQUIV~1\Grisoft\AVG7\avgemc.exe
C:\Arquivos de programas\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\svchost.exe
C:\Arquivos de programas\internet explorer\iexplore.exe
C:\Documents and Settings\Roberto\programas\eMule0.48a\emule.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Roberto\programas\Spyware.exe.exe

O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\WINDOWS\Downloaded Program Files\gbiehCef.dll
O2 - BHO: G-Buster Browser Defense Unibanco - {C41A1C0E-EA6C-11D4-B1B8-444553540008} - C:\WINDOWS\Downloaded Program Files\gbiehuni.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [EPSON Stylus C67 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAL.EXE /P23 "EPSON Stylus C67 Series" /O6 "USB001" /M "Stylus C67"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Scanner Utilities.lnk = C:\WINDOWS\twain_32\Minipa\ms9600c\SCANER32.EXE
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399003} (GbPluginObj Class) - https://imagem.caixa.gov.br/cab/GbPluginCef.cab
O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399008} (GbPluginObj Class) - https://clickbanking.unibanco.com.br/GbPlug…GbPluginUni.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgemc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Arquivos de programas\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Gbp Service (GbpSv) - Unknown owner - C:\Arquivos de programas\GbPlugin\GbpSv.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Arquivos de programas\Arquivos comuns\Macromedia Shared\Service\Macromedia Licensing.exe
Post #20
A. Your copy od Mirc is definitively infected. It must be uninstalled from your machine. You can download a new copy after we have finished our work.

Using the Add/Remove Programs module in your Control Panel, UNINSTALL the following program: MIRC


B. 1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\Documents and Settings\MARCOS\.housecall6.6\Quarantine\revelation.zip.bac_a00312
F:\MARCOS\Programas\GETRT411.EXE
F:\MARCOS\Programas\AGSetup0608.exe
F:\MARCOS\Programas\GroksterUpdate151.exe
F:\MARCOS\Programas\AGSetup0609.exe
F:\MARCOS\Programas\GDiVX1.9.9.5.exe
F:\MARCOS\Programas\CoreAAC-1.2.0.575rev3.zip
F:\MARCOS\Programas\CoreAAC-1.2.0.575rev3\CoreAAC-1.2.0.575-3.exe	   

Folder::
F:\MARCOS\Programas\mirc


3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]


5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.

In addition, please tell me how your system is running. If all is well, just give me the OK and we will proceed with the final cleanup measures.

Trevuren
Post #21
hi! i wonder if is there any way that we can desinfect this program and file without remove it? it's because it's not really my material or files. Thanks for everything, for now.
Post #23
I hope you are well and not experiencing any difficulties carrying out my last set of instructions. If you are, do not hesitate to ask for further explanations. If however, your problem has been solved or you no longer require our assistance, please advise us accordingly and we will archive your topic.

Trevuren

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI