All pastes #719038 Raw Edit

Anonymous

public text v1 · immutable
#719038 ·published 2007-09-28 21:52 UTC
rendered paste body
Logfile of HijackThis v1.99.1
Scan saved at 18:50:46, on 28/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccSetMgr.exe
C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccEvtMgr.exe
C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe
C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Arquivos de programas\Symantec AntiVirus\DefWatch.exe
C:\Arquivos de programas\Microsoft Firewall Client 2004\FwcAgent.exe
C:\Arquivos de programas\Arquivos comuns\Microsoft 

Shared\VS7DEBUG\MDM.EXE
C:\Arquivos de programas\Symantec AntiVirus\SavRoam.exe
C:\Arquivos de programas\Symantec AntiVirus\Rtvscan.exe
C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\Explorer.EXE
C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe
C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\Microsoft Firewall Client 2004\FwcMgmt.exe
C:\Arquivos de programas\MSN Messenger\msnmsgr.exe
C:\Arquivos de programas\MSN Messenger\usnsvc.exe
C:\Arquivos de programas\Outlook Express\msimn.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\Arquivos de programas\WinRAR\WinRAR.exe
C:\DOCUME~1\Layout\CONFIG~1\Temp\Rar$EX01.150\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = 

http://www.livrariacultura.com.br/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 

http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL 

= http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 

http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = 

http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet 

Settings,ProxyServer = isaserver:8080
O2 - BHO: Facilitador de Leitor de Link Adobe PDF - 

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de 

programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no 

file)
O2 - BHO: Windows Live Sign-in Helper - 

{9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de 

programas\Arquivos comuns\Microsoft Shared\Windows 

Live\WindowsLiveLogin.dll
O2 - BHO: G-Buster Browser Defense - 

{C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\WINDOWS\Downloaded Program 

Files\gbieh.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Arquivos de programas\Arquivos 

comuns\Real\Update_OB\realsched.exe"  -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: BrOffice.org 2.2.lnk = C:\Arquivos de 

programas\BrOffice.org 2.2\program\quickstart.exe
O4 - Global Startup: Microsoft Firewall Client Management.lnk = ?
O8 - Extra context menu item: E&xportar para o Microsoft Excel - 

res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} 

- C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\arquivos de programas\microsoft 

firewall client 2004\fwcwsp.dll
O10 - Unknown file in Winsock LSP: c:\arquivos de programas\microsoft 

firewall client 2004\fwcwsp.dll
O10 - Unknown file in Winsock LSP: c:\arquivos de programas\microsoft 

firewall client 2004\fwcwsp.dll
O10 - Unknown file in Winsock LSP: c:\arquivos de programas\microsoft 

firewall client 2004\fwcwsp.dll
O10 - Unknown file in Winsock LSP: c:\arquivos de programas\microsoft 

firewall client 2004\fwcwsp.dll
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: 

SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - 

http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {41ACD49D-1974-791A-0981-AA9872721044} (Ganymede Board 

Games) - http://200.212.184.212/g_bin/eng/boards_2_0_0_32.cab
O16 - DPF: {4B4513E2-4E57-43DF-9496-FCD37E9DFA64} (GameDesire Sea 

Battle) - http://200.212.184.212/g_bin/eng/navy_2_0_0_27.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) 

- 

http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/

wuweb_site.cab?1160700830235
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - 

Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word 

Games) - http://200.212.184.212/g_bin/eng/words_2_0_0_50.cab
O16 - DPF: {BFA1F11D-3121-AFE1-4112-983219421AEF} (GameDesire 1Player 

Word Games) - 

http://200.212.184.212/g_bin/eng/wordssingle_2_0_0_47.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} 

(MessengerStatsClient Class) - 

http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.c

ab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash 

Object) - 

http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} (GbpDistObj Class) - 

https://www14.bancobrasil.com.br/plugin/GbpDist.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) 

- http://200.212.184.212/g_bin/eng/billard8_2_0_0_35.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C2} (GameDesire Pool 9) 

- http://200.212.184.212/g_bin/eng/billard9_2_0_0_35.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) 

- http://200.212.184.212/g_bin/eng/snooker_2_0_0_35.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = 

espm02.espm.br
O17 - HKLM\Software\..\Telephony: DomainName = espm02.espm.br
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = 

espm02.espm.br
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = 

espm02.espm.br
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - 

C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - 

C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Arquivos de 

programas\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} 

- C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL 

Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de 

programas\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Arquivos de 

programas\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Arquivos de 

programas\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec 

Corporation - C:\Arquivos de programas\Arquivos comuns\Symantec 

Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec 

Corporation - C:\Arquivos de programas\Arquivos comuns\Symantec 

Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec 

Corporation - C:\Arquivos de programas\Arquivos comuns\Symantec 

Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - 

Symantec Corporation - C:\Arquivos de programas\Symantec 

AntiVirus\DefWatch.exe
O23 - Service: Gbp Service (GbpSv) - GAS Tecnologia LTDA - C:\Arquivos 

de programas\GbPlugin\GbpSv.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Arquivos de 

programas\Symantec AntiVirus\SavRoam.exe
O23 - Service: ServiceLayer - Nokia. - C:\Arquivos de programas\PC 

Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec 

Corporation - C:\Arquivos de programas\Arquivos comuns\Symantec 

Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Arquivos 

de programas\Symantec AntiVirus\Rtvscan.exe