rendered paste bodyDDS (Ver_10-03-17.01) - NTFSx86
Run by Famlia at 17:03:30,76 on seg 26/07/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.511.255 [GMT -3:00]
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
============== Running Processes ===============
C:\ARQUIV~1\GbPlugin\GbpSv.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe
C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Arquivos de programas\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\ARQUIV~1\Bandoo\Bandoo.exe
C:\WINDOWS\System32\alg.exe
C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe
C:\ARQUIV~1\WI9130~1\DataMngr\DataMngrUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Arquivos de programas\Windows Live\Contacts\wlcomm.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Documents and Settings\Famlia\Desktop\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe
============== Pseudo HJT Report ===============
uSearch Page = hxxp://www.google.com
uStart Page = hxxp://www.searchqu.com/
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - c:\arquivos de programas\ask.com\GenericAskToolbar.dll
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\arquivos de programas\hp\smart web printing\hpswp_printenhancer.dll
BHO: HP Print Clips: {053f9267-dc04-4294-a72c-58f732d338c0} - c:\arquivos de programas\hp\smart web printing\hpswp_framework.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\arquivos de programas\arquivos comuns\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Auxiliar de Conexo do Windows Live: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\arquivos de programas\arquivos comuns\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Flash Video Decoder for FLV: {9dba8979-f8be-4b48-99f7-3cd7b23ce1cb} - c:\windows\system32\flash10fla.dll
BHO: GbIehObj Class: {c41a1c0e-ea6c-11d4-b1b8-444553540014} - c:\arquivos de programas\gbplugin\gbiehbnb.dll
BHO: aTube Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\arquivos de programas\ask.com\GenericAskToolbar.dll
BHO: BandooIEPlugin Class: {eb5cee80-030a-4ed8-8e20-454e9c68380f} - c:\arquivos de programas\bandoo\plugins\ie\ieplugin.dll
TB: aTube Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\arquivos de programas\ask.com\GenericAskToolbar.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [msnmsgr] "c:\arquivos de programas\windows live\messenger\msnmsgr.exe" /background
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [Adobe Reader Speed Launcher] "c:\arquivos de programas\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\arquivos de programas\arquivos comuns\adobe\arm\1.0\AdobeARM.exe"
mRun: [avgnt] "c:\arquivos de programas\avira\antivir desktop\avgnt.exe" /min
mRun: [DataMngr] c:\arquiv~1\wi9130~1\datamngr\DataMngrUI.exe
mRunServices: [csrcs] c:\windows\system32\csrcs.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
dRunOnce: [nltide_2] regsvr32 /s /n /i:U shell32
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportar para o Microsoft Excel - c:\arquiv~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}
IE: {58ECB495-38F0-49cb-A538-10282ABF65E7} - {E763472E-A716-4CD9-89BD-DBDA6122F741} - c:\arquivos de programas\hp\smart web printing\hpswp_extensions.dll
IE: {700259D7-1666-479a-93B1-3250410481E8} - {A93C41D8-01F8-4F8B-B14C-DE20B117E636} - c:\arquivos de programas\hp\smart web printing\hpswp_extensions.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\arquiv~1\micros~2\office11\REFIEBAR.DLL
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1263757355375
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} - hxxps://passare.bnb.gov.br/agb/install/GbpDist.cab
TCP: {79987E27-2241-45AB-BE15-BB636FB40588} = 200.223.189.65,200.223.189.67
TCP: {DEF416E2-1C01-4C57-BF7E-C5A85EAD423A} = 200.223.189.70 200.223.189.65
Notify: GbPluginBnb - c:\arquivos de programas\gbplugin\gbiehBnb.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll
SEH: GbPluginObj Class: {e37cb5f0-51f5-4395-a808-5fa49e399014} - c:\arquivos de programas\gbplugin\gbiehbnb.dll
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\famlia~1\dadosd~1\mozilla\firefox\profiles\3qj8cspf.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.br/
FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=ATU3&o=15380&locale=pt_BR&apn_uid=84054ADA-FF4D-493C-8F05-17A05C0562AD&apn_ptnrs=UJ&apn_sauid=603BA6D4-EE37-4F8B-B6DD-958EE161A040&apn_dtid=&q=
FF - component: c:\documents and settings\famlia\dados de aplicativos\mozilla\firefox\profiles\3qj8cspf.default\extensions\firefox@bandoo.com\components\FFPlugin.dll
FF - plugin: c:\arquivos de programas\java\j2re1.4.2_05\bin\NPJPI142_05.dll
FF - plugin: c:\arquivos de programas\k-lite codec pack\real\browser\plugins\nppl3260.dll
FF - plugin: c:\arquivos de programas\k-lite codec pack\real\browser\plugins\nprpjplug.dll
---- FIREFOX POLICIES ----
c:\mozila\greprefs\all.js - pref("ui.use_native_colors", true);
c:\mozila\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\mozila\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\mozila\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\mozila\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\mozila\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\mozila\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\mozila\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\mozila\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\mozila\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\mozila\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\mozila\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\mozila\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\mozila\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\mozila\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\mozila\greprefs\all.js - pref("network.proxy.type", 5);
c:\mozila\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\mozila\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\mozila\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\mozila\greprefs\all.js - pref("svg.smil.enabled", false);
c:\mozila\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\mozila\greprefs\all.js - pref("browser.formfill.debug", false);
c:\mozila\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\mozila\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\mozila\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\mozila\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\mozila\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\mozila\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\mozila\greprefs\all.js - pref("accelerometer.enabled", true);
c:\mozila\greprefs\all.js - pref("html5.enable", false);
c:\mozila\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\mozila\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\mozila\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\mozila\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\mozila\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\mozila\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\mozila\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\mozila\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\mozila\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");
c:\mozila\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\mozila\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\mozila\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\mozila\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\mozila\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\mozila\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\mozila\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\mozila\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\mozila\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\mozila\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\mozila\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\mozila\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\mozila\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\mozila\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
c:\mozila\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\mozila\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\mozila\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
============= SERVICES / DRIVERS ===============
R0 GbpKm;Gbp KernelMode;c:\windows\system32\drivers\gbpkm.sys [2010-7-8 25968]
R1 avgio;avgio;c:\arquivos de programas\avira\antivir desktop\avgio.sys [2010-7-20 11608]
R2 AntiVirSchedulerService;Avira AntiVir Programador;c:\arquivos de programas\avira\antivir desktop\sched.exe [2010-7-20 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\arquivos de programas\avira\antivir desktop\avguard.exe [2010-7-20 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-1-18 56816]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [2010-1-17 8576]
R2 GbpSv;Gbp Service;c:\arquiv~1\gbplugin\GbpSv.exe [2010-7-8 52464]
R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);c:\windows\system32\drivers\RMSPPPOE.SYS [2010-2-18 31424]
R3 rtl8180;Realtek RTL8180 Wireless LAN (Mini-)PCI NIC NT Driver;c:\windows\system32\drivers\RTL8180.sys [2010-1-17 183680]
=============== Created Last 30 ================
2010-07-26 19:52:02 0 d-----w- c:\arquivos de programas\ThumbView_Lite 1.0
2010-07-24 21:50:54 0 d-----w- c:\arquivos de programas\Windows Searchqu Toolbar
2010-07-23 14:52:28 0 d-s---w- C:\ComboFix
2010-07-22 22:16:17 552 ----a-w- c:\windows\system32\d3d8caps.dat
2010-07-22 21:51:42 221184 ----a-w- c:\windows\system32\wmpns.dll
2010-07-22 21:09:39 599040 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2010-07-22 21:09:39 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-07-22 21:09:36 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-07-22 21:09:36 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-07-22 21:09:36 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2010-07-22 21:09:36 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-07-22 21:09:34 11076096 -c----w- c:\windows\system32\dllcache\ieframe.dll
2010-07-22 20:28:13 2194176 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-07-22 20:28:10 2150400 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-07-22 20:28:10 2028544 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-07-22 17:44:17 455680 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-07-22 16:50:00 0 d-sha-r- C:\cmdcons
2010-07-22 15:59:58 0 d-----w- c:\windows\system32\KB905474
2010-07-22 15:52:14 0 d-----w- c:\arquivos de programas\MSXML 4.0
2010-07-22 15:04:47 98816 ----a-w- c:\windows\sed.exe
2010-07-22 15:04:47 77312 ----a-w- c:\windows\MBR.exe
2010-07-22 15:04:47 256512 ----a-w- c:\windows\PEV.exe
2010-07-22 15:04:47 161792 ----a-w- c:\windows\SWREG.exe
2010-07-22 14:33:51 327896 -c--a-w- c:\windows\system32\dllcache\wucltui.dll
2010-07-22 14:33:51 217816 -c--a-w- c:\windows\system32\dllcache\wuaucpl.cpl
2010-07-22 14:33:51 217816 ----a-w- c:\windows\system32\wuaucpl.cpl
2010-07-21 19:39:59 0 d-----w- c:\docume~1\famlia~1\dadosd~1\Malwarebytes
2010-07-21 19:39:47 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-21 19:39:43 0 d-----w- c:\docume~1\alluse~1\dadosd~1\Malwarebytes
2010-07-21 19:39:42 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-21 19:39:42 0 d-----w- c:\arquivos de programas\Malwarebytes' Anti-Malware
2010-07-21 00:14:03 0 d-----w- c:\docume~1\alluse~1\dadosd~1\Avira
2010-07-21 00:14:03 0 d-----w- c:\arquivos de programas\Avira
2010-07-08 17:35:45 25968 ----a-w- c:\windows\system32\drivers\gbpkm.sys
2010-07-08 17:34:49 0 d-----w- c:\docume~1\alluse~1\dadosd~1\GbPlugin
2010-07-08 17:34:49 0 d-----w- c:\arquivos de programas\GbPlugin
==================== Find3M ====================
2010-07-23 20:19:00 48628 ----a-w- c:\windows\system32\perfc016.dat
2010-07-23 20:19:00 344380 ----a-w- c:\windows\system32\perfh016.dat
2010-06-20 22:01:49 536064 ----a-w- c:\documents and settings\famlia\RegShellSM.exe
2010-05-06 10:34:18 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-02 08:08:34 1851392 ----a-w- c:\windows\system32\win32k.sys
2006-05-03 10:06:54 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 11:47:16 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 13:30:52 216064 --sh--r- c:\windows\system32\nbDX.dll
2010-01-17 13:20:48 32768 --sha-w- c:\windows\system32\config\systemprofile\configuraes locais\histrico\history.ie5\index.dat
2010-01-17 13:20:44 32768 --sha-w- c:\windows\system32\config\systemprofile\configuraes locais\histrico\history.ie5\mshist012010011720100118\index.dat
2010-01-17 13:20:48 32768 --sha-w- c:\windows\system32\config\systemprofile\configuraes locais\temporary internet files\content.ie5\index.dat
2010-01-17 13:20:48 16384 --sha-w- c:\windows\system32\config\systemprofile\cookies\index.dat
2010-04-11 17:48:06 32768 --sha-w- c:\windows\temp\cookies\index.dat
2010-04-11 17:48:06 32768 --sha-w- c:\windows\temp\history\history.ie5\index.dat
2010-04-11 17:48:06 49152 --sha-w- c:\windows\temp\temporary internet files\content.ie5\index.dat
============= FINISH: 17:04:08,28 ===============