My computer take a long time to start

[jefferson2008br]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:48:34, on 12/5/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe
C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\VTTimer.exe
C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe
C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe
C:\Arquivos de programas\gnrdb.exe
C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe
C:\Arquivos de programas\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\WINDOWS\System32\svchost.exe
C:\Arquivos de programas\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Arquivos de programas\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe
C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe
C:\Arquivos de programas\MSN Messenger\usnsvc.exe
D:\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://pt.wikipedia.org/
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Atualizador - Puxa Rápido] C:\Arquivos de programas\Puxa Rápido\Atualiza.exe
O4 - HKLM\..\Run: [BQQBLHFA] c:\windows\system32\bqqblhfa.exe
O4 - HKLM\..\Run: [bios] C:\WINDOWS\System32\bios.exe
O4 - HKLM\..\Run: [SymantecFilterCheck] C:\WINDOWS\help\svhost.exe
O4 - HKLM\..\Run: [Protector GB] C:\WINDOWS\help\protectgb.exe
O4 - HKLM\..\Run: [Msn 8.0 Live] C:\WINDOWS\help\msn.exe
O4 - HKLM\..\Run: [Hot 8.0 Live] C:\WINDOWS\help\hot.exe
O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Pandora] C:\Arquivos de programas\gnrdb.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Ferramenta de Verificação de MÃ*dia do Cyber-shot Viewer.lnk = C:\Arquivos de programas\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\MSMSGS.EXE
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {41ACD49D-1974-791A-0981-AA9872721044} (Ganymede Board Games) - http://200.212.184.212/g_bin/eng/boards_2_0_0_34.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by120fd.bay120.hotmail.msn.co...s/MsnPUpld.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase4009.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C193E1F-1F37-4F03-BDFC-812EAE9B94C2}: NameServer = 200.165.90.70 200.149.55.142
O20 - Winlogon Notify: GbPluginAbn - C:\ARQUIV~1\GbPlugin\gbiehabn.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Gbp Service (GbpSv) - Unknown owner - C:\ARQUIV~1\GbPlugin\GbpSv.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

--
End of file - 6223 bytes


My computer take 5 minutes to start. I need that anyone helps me. I need to know if my computer are infected or it has any useless process.
I will thank a lot the help!

[crunchie]

Hi and welcome to the VDr forums .

=========

Please download and install AVG antispyware tool

• Close all other Applications Select language click Ok
• Click I Agree
• Click next
• Click Install
• Click Finish
• Wait and AVG antispyware will open to the main screen automatically.
• Wait again a few minutes and AVG antispyware Should Auto update itself. If it doesn't click update at top of screen.
• It is very important that you get updated
• When updating has finished. Close AVG antispyware.

If you have an "always on" connection to the internet, physically disconnect that connection until you are finished with Safe Mode and have rebooted back into normal mode.

• Next, please reboot your computer in Safe Mode by doing the following:
• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
• Instead of Windows loading as normal, a menu should appear use arrow up to highlight
• Select the first option, to run Windows in Safe Mode hit enter.
• For additional help in booting into Safe Mode, see the following site: HERE
  
  You MUST manage to get into Safe Mode for the fix to work.

Make sure to close all open windows/programs/folders. Have nothing else open while AVG antispyware performs its scan!

• Run AVG antispyware.
• Click on scanner at top of AVG antispyware screen.
• Click on Settings.
• Under How to Act click on Recommended Action and choose Quarantine.
• Under How to scan all boxes should be selected.
• Under Possibly unwanted software all boxes should be selected.
• On right side under Reports: click on Do not automatically generate report after every scan.
• Under What to scan select scan every file.
• Click On scan Tab.
• Click on Complete system scan.
• Let the program scan the machine It can take awhile give it time.
• When scan has finished at bottom of screen click Apply all Actions.
• Click Save report
• Click Save Report as (Save as window's screen should pop up.)
• Click desktop.
• Click Save.
• Exit AVG antispyware.

Reboot back to normal mode.
Post the log here.

==

Download Malwarebytes' Anti-Malware (http://www.majorgeeks.com/Malwarebyt...are_d5756.html) to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure to checkmark the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Make sure that you restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

Post new HJT log.

==

I would advise you to immediately change ALL of your online banking passwords using a safe/clean pc. Your pc is harbouring several password stealing trojans and keyloggers.

[jefferson2008br]

WARNING! - It's in Portuguese!

---------------------------------------------------------
AVG Anti-Spyware - Relatório de verificação
---------------------------------------------------------

+ Criação: 09:31:40 15/5/2008

+ Resultado da verificação:



HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Limpo com backup (em quarentena).
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Limpo com backup (em quarentena).
HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Erro durante a limpeza.
HKU\S-1-5-21-73586283-602162358-682003330-1003\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Limpo com backup (em quarentena).
C:\Documents and Settings\Adm\Cookies\adm@247realmedia[1].txt -> TrackingCookie.247realmedia : Limpo.
C:\Documents and Settings\Adm\Configurações locais\Temp\Cookies\adm@2o7[2].txt -> TrackingCookie.2o7 : Limpo.
C:\Documents and Settings\Adm\Configurações locais\Temp\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@2o7[2].txt -> TrackingCookie.2o7 : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][2].txt -> TrackingCookie.Adbrite : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][2].txt -> TrackingCookie.Adbrite : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@adbrite[1].txt -> TrackingCookie.Adbrite : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.Adbrite : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.Adrevolver : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@adtech[2].txt -> TrackingCookie.Adtech : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@advertising[1].txt -> TrackingCookie.Advertising : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@adviva[1].txt -> TrackingCookie.Adviva : Limpo.
C:\Documents and Settings\Adm\Configurações locais\Temp\Cookies\adm@atdmt[2].txt -> TrackingCookie.Atdmt : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@atdmt[2].txt -> TrackingCookie.Atdmt : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@bluestreak[2].txt -> TrackingCookie.Bluestreak : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@burstnet[2].txt -> TrackingCookie.Burstnet : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][2].txt -> TrackingCookie.Burstnet : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@casalemedia[2].txt -> TrackingCookie.Casalemedia : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@centrport[1].txt -> TrackingCookie.Centrport : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@clickbank[1].txt -> TrackingCookie.Clickbank : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][2].txt -> TrackingCookie.Comclick : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.Coremetrics : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.Dealtime : Limpo.
C:\Documents and Settings\Adm\Configurações locais\Temp\Cookies\adm@doubleclick[1].txt -> TrackingCookie.Doubleclick : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@doubleclick[1].txt -> TrackingCookie.Doubleclick : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@enhance[1].txt -> TrackingCookie.Enhance : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@estat[1].txt -> TrackingCookie.Estat : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.Euroclick : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.Falkag : Limpo.
C:\Documents and Settings\Adm\Configurações locais\Temp\Cookies\adm@fastclick[1].txt -> TrackingCookie.Fastclick : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@fastclick[2].txt -> TrackingCookie.Fastclick : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.Gamershell : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@gamershell[2].txt -> TrackingCookie.Gamershell : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.Gemius : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][2].txt -> TrackingCookie.Hitbox : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][2].txt -> TrackingCookie.Hitbox : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.Hitbox : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][2].txt -> TrackingCookie.Hitbox : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][2].txt -> TrackingCookie.Hitbox : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.Hitbox : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][2].txt -> TrackingCookie.Hitbox : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.Hitbox : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.Hitbox : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@hitbox[2].txt -> TrackingCookie.Hitbox : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@hotlog[2].txt -> TrackingCookie.Hotlog : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][2].txt -> TrackingCookie.Information : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@ivwbox[2].txt -> TrackingCookie.Ivwbox : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@komtrack[2].txt -> TrackingCookie.Komtrack : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][2].txt -> TrackingCookie.Liveperson : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@mediaplex[2].txt -> TrackingCookie.Mediaplex : Limpo.
C:\Documents and Settings\Adm\Configurações locais\Temp\Cookies\[email protected][1].txt -> TrackingCookie.Msn : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][2].txt -> TrackingCookie.Msn : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][2].txt -> TrackingCookie.Msn : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][2].txt -> TrackingCookie.Netflame : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][2].txt -> TrackingCookie.Onestat : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@overture[1].txt -> TrackingCookie.Overture : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.Overture : Limpo.
C:\Documents and Settings\Adm\Configurações locais\Temp\Cookies\[email protected][1].txt -> TrackingCookie.Pointroll : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.Pointroll : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@pro-market[2].txt -> TrackingCookie.Pro-market : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@questionmarket[1].txt -> TrackingCookie.Questionmarket : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@realmedia[1].txt -> TrackingCookie.Realmedia : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.Realtracker : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@revenue[1].txt -> TrackingCookie.Revenue : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@revsci[1].txt -> TrackingCookie.Revsci : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.Ru4 : Limpo.
C:\Documents and Settings\Adm\Configurações locais\Temp\Cookies\[email protected][2].txt -> TrackingCookie.Serving-sys : Limpo.
C:\Documents and Settings\Adm\Configurações locais\Temp\Cookies\adm@serving-sys[1].txt -> TrackingCookie.Serving-sys : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][2].txt -> TrackingCookie.Serving-sys : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@serving-sys[2].txt -> TrackingCookie.Serving-sys : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][1].txt -> TrackingCookie.Sextracker : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@sextracker[1].txt -> TrackingCookie.Sextracker : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][2].txt -> TrackingCookie.Skype : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@skype[2].txt -> TrackingCookie.Skype : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@smartadserver[2].txt -> TrackingCookie.Smartadserver : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@statcounter[1].txt -> TrackingCookie.Statcounter : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][2].txt -> TrackingCookie.Tacoda : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@tacoda[1].txt -> TrackingCookie.Tacoda : Limpo.
C:\Documents and Settings\Adm\Configurações locais\Temp\Cookies\adm@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][2].txt -> TrackingCookie.Valuead : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@weborama[2].txt -> TrackingCookie.Weborama : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][2].txt -> TrackingCookie.Webtrends : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][2].txt -> TrackingCookie.Webtrendslive : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@yadro[1].txt -> TrackingCookie.Yadro : Limpo.
C:\Documents and Settings\Adm\Configurações locais\Temp\Cookies\[email protected][2].txt -> TrackingCookie.Yieldmanager : Limpo.
C:\Documents and Settings\Adm\Cookies\[email protected][2].txt -> TrackingCookie.Yieldmanager : Limpo.
C:\Documents and Settings\Adm\Cookies\adm@zedo[1].txt -> TrackingCookie.Zedo : Limpo.


::Fim do relatório


There you are sir! What is your opinion about this?
Thank you very much!

P.S.: Limpar - To clean

[Train]

Just in case.
HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Erro durante a limpeza.

Erro durante a limpeza.= error during clean up.

[crunchie]

Thanks Train .
jefferson2008br. There were three parts to my reply. You have done only one. Please do the rest so we can continue.

[jefferson2008br]

Here you are:

WARNING: in Portuguese!

Malwarebytes' Anti-Malware 1.12
Versão do banco de dados: 755

Tipo de Verificação: Completa (C:\|)
Objetos verificados: 102560
Tempo decorrido: 19 minute(s), 5 second(s)

Processos da Memória infectados: 0
Módulos de Memória Infectados: 0
Chaves do Registro infectadas: 0
Valores do Registro infectados: 0
�tens do Registro infectados: 0
Pastas infectadas: 0
Arquivos infectados: 1

Processos da Memória infectados:
(Nenhum Ã*tem malicioso foi detectado)

Módulos de Memória Infectados:
(Nenhum Ã*tem malicioso foi detectado)

Chaves do Registro infectadas:
(Nenhum Ã*tem malicioso foi detectado)

Valores do Registro infectados:
(Nenhum Ã*tem malicioso foi detectado)

�tens do Registro infectados:
(Nenhum Ã*tem malicioso foi detectado)

Pastas infectadas:
(Nenhum Ã*tem malicioso foi detectado)

Arquivos infectados:
C:\WINDOWS\ponto.DLL (Malware.Trace) -> Quarantined and deleted successfully.

[crunchie]

Cool. Malwarebytes needs updating to the latest version and running again.
By my calculation, you still have one more step to go.

[jefferson2008br]

I'm Sorry,sir. but, what is the third part?

[crunchie]

1

Please download and install AVG antispyware tool

• Close all other Applications Select language click Ok
• Click I Agree
• Click next
• Click Install
• Click Finish
• Wait and AVG antispyware will open to the main screen automatically.
• Wait again a few minutes and AVG antispyware Should Auto update itself. If it doesn't click update at top of screen.
• It is very important that you get updated
• When updating has finished. Close AVG antispyware.

If you have an "always on" connection to the internet, physically disconnect that connection until you are finished with Safe Mode and have rebooted back into normal mode.

• Next, please reboot your computer in Safe Mode by doing the following:
• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
• Instead of Windows loading as normal, a menu should appear use arrow up to highlight
• Select the first option, to run Windows in Safe Mode hit enter.
• For additional help in booting into Safe Mode, see the following site: HERE
  
  You MUST manage to get into Safe Mode for the fix to work.

Make sure to close all open windows/programs/folders. Have nothing else open while AVG antispyware performs its scan!

• Run AVG antispyware.
• Click on scanner at top of AVG antispyware screen.
• Click on Settings.
• Under How to Act click on Recommended Action and choose Quarantine.
• Under How to scan all boxes should be selected.
• Under Possibly unwanted software all boxes should be selected.
• On right side under Reports: click on Do not automatically generate report after every scan.
• Under What to scan select scan every file.
• Click On scan Tab.
• Click on Complete system scan.
• Let the program scan the machine It can take awhile give it time.
• When scan has finished at bottom of screen click Apply all Actions.
• Click Save report
• Click Save Report as (Save as window's screen should pop up.)
• Click desktop.
• Click Save.
• Exit AVG antispyware.

Reboot back to normal mode.
Post the log here.

2

Download Malwarebytes' Anti-Malware (http://www.majorgeeks.com/Malwarebyt...are_d5756.html) to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure to checkmark the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Make sure that you restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

3

Post new HJT log.

[jefferson2008br]

Oh, thank you, sir!

Here you are:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:01:16, on 20/5/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\VTTimer.exe
C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe
C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe
D:\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe
C:\Arquivos de programas\gnrdb.exe
C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe
C:\Arquivos de programas\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Arquivos de programas\HP\Digital Imaging\bin\hpqSTE08.exe
D:\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\Arquivos de programas\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Arquivos de programas\MSN Messenger\usnsvc.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
D:\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://pt.wikipedia.org/
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Atualizador - Puxa Rápido] C:\Arquivos de programas\Puxa Rápido\Atualiza.exe
O4 - HKLM\..\Run: [BQQBLHFA] c:\windows\system32\bqqblhfa.exe
O4 - HKLM\..\Run: [bios] C:\WINDOWS\System32\bios.exe
O4 - HKLM\..\Run: [SymantecFilterCheck] C:\WINDOWS\help\svhost.exe
O4 - HKLM\..\Run: [Protector GB] C:\WINDOWS\help\protectgb.exe
O4 - HKLM\..\Run: [Msn 8.0 Live] C:\WINDOWS\help\msn.exe
O4 - HKLM\..\Run: [Hot 8.0 Live] C:\WINDOWS\help\hot.exe
O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Pandora] C:\Arquivos de programas\gnrdb.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Ferramenta de Verificação de MÃ*dia do Cyber-shot Viewer.lnk = C:\Arquivos de programas\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\MSMSGS.EXE
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {41ACD49D-1974-791A-0981-AA9872721044} (Ganymede Board Games) - http://200.212.184.212/g_bin/eng/boards_2_0_0_34.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by120fd.bay120.hotmail.msn.co...s/MsnPUpld.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase4009.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C193E1F-1F37-4F03-BDFC-812EAE9B94C2}: NameServer = 200.165.90.70 200.149.55.142
O20 - Winlogon Notify: GbPluginAbn - C:\ARQUIV~1\GbPlugin\gbiehabn.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Gbp Service (GbpSv) - Unknown owner - C:\ARQUIV~1\GbPlugin\GbpSv.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

--
End of file - 6128 bytes

[crunchie]

Download
SDFix
and save it to your desktop.

Please then reboot your computer in Safe Mode by doing the
following :

• Restart your computer
• After hearing your computer beep once during startup, but before the
  Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, a menu with options should appear;
• Select the first option, to run Windows in Safe Mode, then press "Enter".
• Choose your usual account.

• In Safe Mode, right click the SDFix.zip folder and choose Extract
  All,
• Open the extracted folder and double click RunThis.bat to
  start the script.
• Type Y to begin the script.
• It will remove the Trojan Services then make some repairs to the
  registry and prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• Your system will take longer that normal to restart as the fixtool
  will be running and removing files.
• When the desktop loads the Fixtool will complete the removal and
  display Finished, then press any key to end the script and load
  your desktop icons.
• Finally open the SDFix folder on your desktop and copy and paste the
  contents of the results file Report.txt back onto the forum with
  a new HijackThis log

[jefferson2008br]

OK. In my desktop, it was created the file "cacthme.log" Its content:

catchme 0.3.1359 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-21 09:27:40
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden files ...

IPC error: 2 O sistema não pode encontrar o arquivo especificado.
scan completed successfully
hidden files: 0

Is this what you want?

[crunchie]

That log is incomplete. Please post the entire log. You also need to post a new hijackthis log, as requested.