help removing trojan viruses....

May I have some help removing it?
My hijack log.. (IM Brazilian and don't speak english so good.. sorry)

___________________________________________________________________
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:30, on 2008-02-29
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe
C:\ARQUIV~1\GbPlugin\GbpSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe
C:\Arquivos de programas\antiviirus.exe
C:\WINDOWS\system32\drivers\spools.exe
C:\Arquivos de programas\MSN Messenger\msnmsgr.exe
C:\WINDOWS\DvzCommon\DvzMsgr.exe
C:\WINDOWS\system32\drivers\spools.exe
C:\WINDOWS\system32\spoolsv.exe
C:\DOCUME~1\windows\CONFIG~1\Temp\4uGh5JK0.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\winlagan.exe
C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\TEMP\rwoncbws.exe
C:\Documents and Settings\LocalService\Dados de aplicativos\printer.exe
C:\WINDOWS\TEMP\kjj.exe
C:\WINDOWS\TEMP\gfvwnhup.exe
C:\WINDOWS\TEMP\rsysinit.exe
C:\DOCUME~1\windows\CONFIG~1\Temp\csrssc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\mmoc2.exe
C:\WINDOWS\mmhr3.exe
C:\WINDOWS\mmmega.exe
C:\Arquivos de programas\Mozilla Firefox\firefox.exe
C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\shell.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\TEMP\services.exe
O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RDL Rolex - {6027FDCA-AE2C-438B-8535-3A96C154F97C} - C:\WINDOWS\dgtxrdfqnt.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: C:\WINDOWS\system32\Fsd9mk4g.dll - {B5AF0562-94F3-42BD-F434-2604812C797D} - C:\WINDOWS\system32\Fsd9mk4g.dll
O2 - BHO: e404 helper - {C03FD59D-9104-44B7-929A-9EAA0BA05211} - C:\Arquivos de programas\Helper\1204316496.dll
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\ARQUIV~1\GbPlugin\gbieh.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [antiviirus] C:\Arquivos de programas\antiviirus.exe
O4 - HKLM\..\Run: [advap32] c:\74.tmp/r
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [autoload] C:\Documents and Settings\windows\Local Settings\Application Data\cftmon.exe
O4 - HKLM\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
O4 - HKLM\..\Run: [Streams Drivers] C:\WINDOWS\TEMP\services.exe
O4 - HKLM\..\Run: [jkdfj94kgdftdf] C:\WINDOWS\TEMP\winlogan.exe
O4 - HKLM\..\Run: [Microsoft all] C:\WINDOWS\mmall.exe
O4 - HKLM\..\Run: [Printer] C:\WINDOWS\system32\printer.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SVCHOST.EXE] C:\WINDOWS\system32\drivers\svchost.exe
O4 - HKCU\..\Run: [autoload] C:\Documents and Settings\windows\Local Settings\Application Data\cftmon.exe
O4 - HKCU\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
O4 - HKCU\..\Run: [Jnskdfmf9eldfd] C:\DOCUME~1\windows\CONFIG~1\Temp\csrssc.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [jkdfj94kgdftdf] C:\WINDOWS\TEMP\winlogan.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Microsoft all] C:\WINDOWS\mmall.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Spoolsv] C:\WINDOWS\system32\spoolvs.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: HotSync Manager.lnk = C:\Arquivos de programas\Palm\HOTSYNC.EXE
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: autorun.exe
O4 - Global Startup: DataViz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} (GbpDistObj Class) - https://www14.bancobrasil.com.br/plugin/GbpDist.cab
O20 - Winlogon Notify: GbPluginBb - C:\ARQUIV~1\GbPlugin\gbieh.dll
O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll
O20 - Winlogon Notify: WLCtrl32 - C:\WINDOWS\SYSTEM32\WLCtrl32.dll
O21 - SSODL: alofkmn - {96E9C49D-363E-45A2-848B-80D4DE41246B} - C:\WINDOWS\alofkmn.dll
O21 - SSODL: bxlrvps - {207F3F79-B240-47A3-88AE-217EEA62C0F8} - C:\WINDOWS\bxlrvps.dll (file missing)
O21 - SSODL: WinAlrt - {704550a0-0838-4631-9ae5-4d4f96b52d85} - C:\WINDOWS\Installer\{704550a0-0838-4631-9ae5-4d4f96b52d85}\WinAlrt.dll
O21 - SSODL: zip - {a7936ff6-f115-4767-9f1b-11ce699e314c} - C:\WINDOWS\Installer\{a7936ff6-f115-4767-9f1b-11ce699e314c}\zip.dll
O21 - SSODL: RamBoot - {615d9a82-a7fd-401b-9108-9e121447b2cf} - C:\WINDOWS\Installer\{615d9a82-a7fd-401b-9108-9e121447b2cf}\RamBoot.dll
O22 - SharedTaskScheduler: JKhfj3ofgfgdtj - {B5AF0562-94F3-42BD-F434-2604812C797D} - C:\WINDOWS\system32\Fsd9mk4g.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Gbp Service (GbpSv) - Unknown owner - C:\ARQUIV~1\GbPlugin\GbpSv.exe
O23 - Service: Google Online Search Service - Unknown owner - C:\WINDOWS\system32\winlagan.exe
O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:exe.exe
O23 - Service: Microsoft security update service (msupdate) - Unknown owner - c:\windows\system32\msvcrtd.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Schedule - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe

--
End of file - 8249 bytes

 

http://pastebin.com/m5baa8132

Here the link for Hijack and DSS logs

Deckard's System Scanner v20071014.68
Run by windows on 2008-02-29 17:40:14
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- HijackThis (run as windows.exe) ---------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:40, on 2008-02-29
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe
C:\ARQUIV~1\GbPlugin\GbpSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe
C:\Arquivos de programas\antiviirus.exe
C:\WINDOWS\system32\drivers\spools.exe
C:\Arquivos de programas\MSN Messenger\msnmsgr.exe
C:\WINDOWS\DvzCommon\DvzMsgr.exe
C:\WINDOWS\system32\drivers\spools.exe
C:\WINDOWS\system32\spoolsv.exe
C:\DOCUME~1\windows\CONFIG~1\Temp\4uGh5JK0.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\winlagan.exe
C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\TEMP\rwoncbws.exe
C:\Documents and Settings\LocalService\Dados de aplicativos\printer.exe
C:\WINDOWS\TEMP\kjj.exe
C:\WINDOWS\TEMP\gfvwnhup.exe
C:\WINDOWS\TEMP\rsysinit.exe
C:\DOCUME~1\windows\CONFIG~1\Temp\csrssc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\mmoc2.exe
C:\WINDOWS\mmhr3.exe
C:\WINDOWS\mmmega.exe
C:\Arquivos de programas\Mozilla Firefox\firefox.exe
C:\Documents and Settings\windows\Desktop\dss.exe
C:\ARQUIV~1\TRENDM~1\HIJACK~1\windows.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\shell.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDO WS\TEMP\services.exe
O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RDL Rolex - {6027FDCA-AE2C-438B-8535-3A96C154F97C} - C:\WINDOWS\dgtxrdfqnt.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: C:\WINDOWS\system32\Fsd9mk4g.dll - {B5AF0562-94F3-42BD-F434-2604812C797D} - C:\WINDOWS\system32\Fsd9mk4g.dll
O2 - BHO: e404 helper - {C03FD59D-9104-44B7-929A-9EAA0BA05211} - C:\Arquivos de programas\Helper\1204316496.dll
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\ARQUIV~1\GbPlugin\gbieh.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [antiviirus] C:\Arquivos de programas\antiviirus.exe
O4 - HKLM\..\Run: [advap32] c:\74.tmp/r
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [autoload] C:\Documents and Settings\windows\Local Settings\Application Data\cftmon.exe
O4 - HKLM\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
O4 - HKLM\..\Run: [Streams Drivers] C:\WINDOWS\TEMP\services.exe
O4 - HKLM\..\Run: [jkdfj94kgdftdf] C:\WINDOWS\TEMP\winlogan.exe
O4 - HKLM\..\Run: [Microsoft all] C:\WINDOWS\mmall.exe
O4 - HKLM\..\Run: [Printer] C:\WINDOWS\system32\printer.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SVCHOST.EXE] C:\WINDOWS\system32\drivers\svchost.exe
O4 - HKCU\..\Run: [autoload] C:\Documents and Settings\windows\Local Settings\Application Data\cftmon.exe
O4 - HKCU\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
O4 - HKCU\..\Run: [Jnskdfmf9eldfd] C:\DOCUME~1\windows\CONFIG~1\Temp\csrssc.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [jkdfj94kgdftdf] C:\WINDOWS\TEMP\winlogan.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Microsoft all] C:\WINDOWS\mmall.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Spoolsv] C:\WINDOWS\system32\spoolvs.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: HotSync Manager.lnk = C:\Arquivos de programas\Palm\HOTSYNC.EXE
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: autorun.exe
O4 - Global Startup: DataViz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System, DisableRegedit=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Pol icies\System, DisableRegedit=1
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} (GbpDistObj Class) - https://www14.bancobrasil.com.br/plugin/GbpDist.cab
O20 - Winlogon Notify: GbPluginBb - C:\ARQUIV~1\GbPlugin\gbieh.dll
O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll
O20 - Winlogon Notify: WLCtrl32 - C:\WINDOWS\SYSTEM32\WLCtrl32.dll
O21 - SSODL: alofkmn - {96E9C49D-363E-45A2-848B-80D4DE41246B} - C:\WINDOWS\alofkmn.dll
O21 - SSODL: bxlrvps - {207F3F79-B240-47A3-88AE-217EEA62C0F8} - C:\WINDOWS\bxlrvps.dll (file missing)
O21 - SSODL: WinAlrt - {704550a0-0838-4631-9ae5-4d4f96b52d85} - C:\WINDOWS\Installer\{704550a0-0838-4631-9ae5-4d4f96b52d85}\WinAlrt.dll
O21 - SSODL: zip - {a7936ff6-f115-4767-9f1b-11ce699e314c} - C:\WINDOWS\Installer\{a7936ff6-f115-4767-9f1b-11ce699e314c}\zip.dll
O21 - SSODL: RamBoot - {615d9a82-a7fd-401b-9108-9e121447b2cf} - C:\WINDOWS\Installer\{615d9a82-a7fd-401b-9108-9e121447b2cf}\RamBoot.dll
O22 - SharedTaskScheduler: JKhfj3ofgfgdtj - {B5AF0562-94F3-42BD-F434-2604812C797D} - C:\WINDOWS\system32\Fsd9mk4g.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Gbp Service (GbpSv) - Unknown owner - C:\ARQUIV~1\GbPlugin\GbpSv.exe
O23 - Service: Google Online Search Service - Unknown owner - C:\WINDOWS\system32\winlagan.exe
O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:exe.exe
O23 - Service: Microsoft security update service (msupdate) - Unknown owner - c:\windows\system32\msvcrtd.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Schedule - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe
--
End of file - 8279 bytes
-- Files created between 2008-01-29 and 2008-02-29 -----------------------------
2008-02-29 17:21:36 0 d-------- C:\Arquivos de programas\Helper
2008-02-29 17:21:06 19968 --a------ C:\WINDOWS\mmmega.exe
2008-02-29 17:20:58 9728 --a------ C:\WINDOWS\system32\spoolvs.exe
2008-02-29 17:20:58 9728 --a------ C:\WINDOWS\system32\printer.exe
2008-02-29 17:20:58 9728 --a------ C:\WINDOWS\shell.exe
2008-02-29 17:20:36 19968 --a------ C:\WINDOWS\mm_tmpmega.exe
2008-02-29 17:20:33 39424 --a------ C:\WINDOWS\mmhr3.exe
2008-02-29 17:20:03 39424 --a------ C:\WINDOWS\mm_tmphr3.exe
2008-02-29 17:20:00 532480 -----n--- C:\WINDOWS\mmoc2.exe
2008-02-29 17:19:18 24064 --a------ C:\WINDOWS\mmall.exe
2008-02-29 17:18:55 35840 --a------ C:\WINDOWS\system32\msvcrtd.exe
2008-02-29 17:18:42 9728 --a------ C:\findfast.exe
2008-02-29 17:18:22 10 --a------ C:\WINDOWS\system32\kr_done1
2008-02-29 17:17:55 5120 -----n--- C:\WINDOWS\system32\ftpdll.dll
2008-02-29 17:17:54 16508 --a------ C:\Arquivos de programas\tmp24843.exe
2008-02-29 17:15:57 53248 --a------ C:\WINDOWS\PSEXESVC.EXE <Not Verified; Sysinternals; Sysinternals PsExec>
2008-02-29 17:15:09 70560 --a------ C:\WINDOWS\system32\drivers\WDICA.sys
2008-02-29 17:12:57 3221 --a------ C:\WINDOWS\system32\ieupdr2.exe
2008-02-29 17:12:50 3221 --a------ C:\WINDOWS\ie_updates3r.exe
2008-02-29 17:11:39 37420 --a------ C:\WINDOWS\system32\pokd429.exe
2008-02-29 17:11:34 2 --a------ C:\212504213
2008-02-29 17:11:31 17920 --a------ C:\WINDOWS\system32\pokd374.exe
2008-02-29 17:10:57 10000 --a------ C:\WINDOWS\system32\Fsd9mk4g.dll
2008-02-29 17:10:46 58368 --a------ C:\tlmnmae.exe
2008-02-29 17:10:30 35992 --a------ C:\Arquivos de programas\tmp67281.exe
2008-02-29 17:10:29 4608 --a------ C:\Arquivos de programas\tmp66750.exe
2008-02-29 17:10:27 4608 --a------ C:\Arquivos de programas\tmp66718.exe
2008-02-29 17:10:06 58368 --a------ C:\WINDOWS\system32\pokd427.exe
2008-02-29 17:09:59 47000 ---hs---- C:\WINDOWS\system32\drivers\spools.exe
2008-02-29 17:09:54 76735 --a------ C:\WINDOWS\system32\pokd414.exe
2008-02-29 17:09:46 26240 --a------ C:\WINDOWS\system32\drivers\Vxu23.sys
2008-02-29 17:09:37 16472 --a------ C:\Arquivos de programas\tmp24296.exe
2008-02-29 17:08:09 11776 --a------ C:\WINDOWS\system32\WLCtrl32.dll
2008-02-29 17:07:52 29696 --a------ C:\WINDOWS\system32\rpcc.dll
2008-02-29 17:07:44 10880 --a------ C:\WINDOWS\system32\drivers\ndisaluo.sys
2008-02-29 17:07:28 3221 --a------ C:\WINDOWS\system32\winlagan.exe
2008-02-29 17:05:39 35784 --a------ C:\Arquivos de programas\instaler.exe
2008-02-29 17:05:38 16540 --a------ C:\Arquivos de programas\tmp13486187.exe
2008-02-29 17:05:28 11876 --a------ C:\Arquivos de programas\antiviirus.exe
2008-02-29 17:05:21 81920 --a------ C:\WINDOWS\fkxvkns.exe
2008-02-29 17:05:21 200704 --a------ C:\WINDOWS\alofkmn.dll <Not Verified; ; alofkmn>
2008-02-24 23:28:24 0 d-------- C:\Arquivos de programas\Google
2008-02-24 02:40:27 68096 --a------ C:\WINDOWS\system32\zip.exe
2008-02-24 02:40:27 98816 --a------ C:\WINDOWS\system32\sed.exe
2008-02-24 02:40:27 80412 --a------ C:\WINDOWS\system32\grep.exe
2008-02-24 02:40:27 73728 --a------ C:\WINDOWS\system32\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-02-24 02:24:08 0 d-------- C:\Arquivos de programas\Trend Micro
2008-02-24 02:06:44 0 d--hs---- C:\WINDOWS\CSC
2008-02-23 14:33:21 0 d-------- C:\Arquivos de programas\AdVantage
2008-02-23 14:33:04 0 d-------- C:\Arquivos de programas\Webteh
2008-02-23 11:37:04 28224 --a------ C:\WINDOWS\system32\1xw7I08H.exe
2008-02-22 21:47:58 87040 --a------ C:\WINDOWS\e01.exe
2008-02-22 21:47:53 23040 --a------ C:\info.exe
2008-02-20 18:08:49 0 d-------- C:\Arquivos de programas\QuickTime
2008-02-20 18:08:38 0 d-------- C:\Arquivos de programas\Apple Software Update
2008-02-19 06:27:33 0 d-------- C:\Arquivos de programas\GbPlugin
2008-02-17 01:25:52 0 d-------- C:\Arquivos de programas\XP Codec Pack
2008-02-17 01:08:09 164352 --a------ C:\WINDOWS\system32\unrar.dll
2008-02-17 01:08:08 217088 --a------ C:\WINDOWS\system32\yv12vfw.dll <Not Verified; www.helixcommunity.org; Helix YV12 YUV Codec>
2008-02-17 01:08:07 159839 --a------ C:\WINDOWS\system32\xvidvfw.dll
2008-02-17 01:08:07 755027 --a------ C:\WINDOWS\system32\xvidcore.dll
2008-02-17 01:08:07 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2008-02-17 01:08:07 81920 --a------ C:\WINDOWS\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100>
2008-02-17 01:08:06 7680 --a------ C:\WINDOWS\system32\ff_vfw.dll
2008-02-17 01:08:06 682496 --a------ C:\WINDOWS\system32\divx.dll <Not Verified; DivX, Inc.; DivX®>
2008-02-17 01:08:05 0 d-------- C:\Arquivos de programas\K-Lite Codec Pack
2008-02-16 15:32:05 0 dr------- C:\renan
2008-02-16 15:28:47 0 d-------- C:\Arquivos de programas\Real Alternative
2008-02-16 15:28:47 0 d-------- C:\Arquivos de programas\Media Player Classic
2008-02-15 23:18:24 0 --a------ C:\WINDOWS\nsreg.dat
2008-02-14 17:56:32 0 d-------- C:\Arquivos de programas\Alwil Software
2008-02-14 13:10:03 0 d-------- C:\Arquivos de programas\MedicSync
2008-02-14 12:59:02 296448 --a------ C:\WINDOWS\system32\midas.dll <Not Verified; Borland Software Corporation; Midas support DLL>
2008-02-14 12:59:02 0 d-------- C:\Arquivos de programas\PneumoSync
2008-02-13 23:13:30 0 d-------- C:\Arquivos de programas\Arquivos comuns\Adobe
2008-02-13 22:00:58 0 d-------- C:\Arquivos de programas\Epocrates
2008-02-13 22:00:58 0 d-------- C:\Arquivos de programas\Arquivos comuns\Epocrates
2008-02-13 21:55:52 0 d-------- C:\WINDOWS\DvzCommon
2008-02-13 21:55:51 0 d-------- C:\Arquivos de programas\Documents To Go
2008-02-13 21:44:00 0 d-------- C:\WINDOWS\Downloaded Installations
2008-02-13 21:42:14 0 d-------- C:\Arquivos de programas\Palm
2008-02-13 21:07:43 0 d-------- C:\WINDOWS\RegisteredPackages
2008-02-13 19:59:12 409600 --a------ C:\WINDOWS\system32\wrap_oal.dll <Not Verified; Creative Labs; Creative Labs OpenAL32>
2008-02-13 19:59:12 114688 --a------ C:\WINDOWS\system32\OpenAL32.dll <Not Verified; Portions © Creative Labs Inc. and NVIDIA Corp.; Standard OpenAL™ Library>
2008-02-13 19:37:08 0 d-------- C:\WINDOWS\system32\ReinstallBackups
2008-02-13 19:37:03 0 d-------- C:\WINDOWS\system32\Data
2008-02-13 19:37:01 0 d-------- C:\Arquivos de programas\Creative
2008-02-13 19:18:13 0 d-------- C:\WINDOWS\pss
2008-02-13 18:44:20 0 d-------- C:\WINDOWS\system32\LogFiles
2008-02-13 18:36:30 0 d-------- C:\Arquivos de programas\Hewlett-Packard
2008-02-13 18:35:36 0 d-------- C:\Arquivos de programas\Arquivos comuns\Hewlett-Packard
2008-02-13 18:33:25 57344 --a------ C:\WINDOWS\system32\HPZisn12.dll <Not Verified; HP; HP SNMP Windows>
2008-02-13 18:33:25 94208 --a------ C:\WINDOWS\system32\HPZipt12.dll <Not Verified; HP; HP SNMP Windows>
2008-02-13 18:33:25 204800 --a------ C:\WINDOWS\system32\HPZipr12.dll <Not Verified; HP; HP PmlRtl>
2008-02-13 18:33:25 69632 --a------ C:\WINDOWS\system32\HPZipm12.exe <Not Verified; HP; HP PML>
2008-02-13 18:33:25 61440 --a------ C:\WINDOWS\system32\HPZinw12.exe <Not Verified; HP; HP Dot4Net Windows>
2008-02-13 18:33:25 278584 --a------ C:\WINDOWS\system32\HPZidr12.dll <Not Verified; HP; HP Dot4Rtl>
2008-02-13 18:33:25 0 d-------- C:\Program Files
2008-02-13 18:33:22 306688 --a------ C:\WINDOWS\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller>
2008-02-13 18:31:04 21124 -----n--- C:\WINDOWS\hpomdl07.dat
2008-02-13 18:31:04 113020 --a------ C:\WINDOWS\hpoins07.dat
2008-02-13 18:27:50 0 d-------- C:\Arquivos de programas\HP
2008-02-13 16:09:34 0 d------c- C:\WINDOWS\system32\DRVSTORE
2008-02-13 16:09:06 0 d-------- C:\Arquivos de programas\MSN Messenger
2008-02-13 16:05:26 0 d-------- C:\WINDOWS\system32\appmgmt
2008-02-13 16:02:26 53 --a------ C:\biosinfo
2008-02-13 15:53:28 0 d-------- C:\WINDOWS\nview
2008-02-13 15:53:26 131072 -ra------ C:\WINDOWS\system32\smdll.dll <Not Verified; ; SMdll Dynamic Link Library>
2008-02-13 15:53:26 128512 -ra------ C:\WINDOWS\system32\MadCHook.dll <Not Verified; www.madshi.net; madCHook>
2008-02-13 15:53:21 32768 -ra------ C:\WINDOWS\system32\Auxiliary.dll
2008-02-13 15:53:20 114688 -ra------ C:\WINDOWS\system32\sysinfo.dll <Not Verified; Crystal Dew World; SysInfo>
2008-02-13 15:53:20 262144 -ra------ C:\WINDOWS\system32\HookShield.dll
2008-02-13 15:53:20 253952 -ra------ C:\WINDOWS\system32\HookMAp.dll
2008-02-13 15:53:19 217088 -ra------ C:\WINDOWS\system32\WinSys2.exe <Not Verified; TODO: <Company name>; TODO: <Product name>>
2008-02-13 15:53:19 9728 -ra------ C:\WINDOWS\system32\sysinfoX64.sys
2008-02-13 15:53:19 8192 -ra------ C:\WINDOWS\system32\sysinfo.sys
2008-02-13 15:53:19 69632 -ra------ C:\WINDOWS\system32\sw24.exe
2008-02-13 15:53:19 208896 -ra------ C:\WINDOWS\system32\sw20.exe <Not Verified; ; sw20 Application>
2008-02-13 15:53:17 1593344 -ra------ C:\WINDOWS\system32\msicpl.dll <Not Verified; MSI; MSI MsiCpl>

-- Find3M Report ---------------------------------------------------------------
2008-02-25 16:21:59 0 d-------- C:\Documents and Settings\windows\Dados de aplicativos\Help
2008-02-24 23:59:26 0 d-------- C:\Documents and Settings\windows\Dados de aplicativos\Google
2008-02-24 23:47:11 0 d-------- C:\Documents and Settings\windows\Dados de aplicativos\Adobe
2008-02-23 15:20:15 0 d-------- C:\Documents and Settings\windows\Dados de aplicativos\BSplayer
2008-02-23 14:33:05 0 d-------- C:\Documents and Settings\windows\Dados de aplicativos\BSplayer Pro
2008-02-23 14:24:34 0 d-------- C:\Documents and Settings\windows\Dados de aplicativos\Apple Computer
2008-02-22 22:42:51 0 d-------- C:\Documents and Settings\windows\Dados de aplicativos\mIRC
2008-02-19 18:29:17 0 d-------- C:\Documents and Settings\windows\Dados de aplicativos\HP
2008-02-16 15:29:05 0 d-------- C:\Documents and Settings\windows\Dados de aplicativos\Media Player Classic
2008-02-16 15:28:47 0 d-------- C:\Documents and Settings\windows\Dados de aplicativos\Real
2008-02-15 23:18:22 0 d-------- C:\Documents and Settings\windows\Dados de aplicativos\Mozilla
2008-02-14 12:48:03 0 d-------- C:\Documents and Settings\windows\Dados de aplicativos\Macromedia
2008-02-13 23:13:30 0 d-------- C:\Arquivos de programas\Arquivos comuns
2008-02-13 23:07:26 0 d-------- C:\Documents and Settings\windows\Dados de aplicativos\Arcsoft
2008-02-13 22:00:58 0 d--h----- C:\Arquivos de programas\InstallShield Installation Information
2008-02-13 21:55:27 0 d-------- C:\Documents and Settings\windows\Dados de aplicativos\Leadertech
2008-02-13 16:05:34 344734 --a------ C:\WINDOWS\system32\perfh016.dat
2008-02-13 16:05:34 48846 --a------ C:\WINDOWS\system32\perfc016.dat
2008-01-18 17:11:21 0 d-------- C:\Arquivos de programas\S3
2008-01-18 17:11:19 0 d-------- C:\Arquivos de programas\Arquivos comuns\InstallShield
2008-01-18 16:52:04 0 d-------- C:\Arquivos de programas\Elaborate Bytes
2008-01-18 16:45:58 0 d-------- C:\Arquivos de programas\Microsoft.NET
2008-01-18 16:45:30 0 d-------- C:\Arquivos de programas\Microsoft Works
2008-01-18 16:35:34 0 d-------- C:\Arquivos de programas\CyberLink
2008-01-18 16:34:37 0 d-------- C:\Arquivos de programas\Arquivos comuns\Ahead
2008-01-18 16:28:54 0 d-------- C:\Arquivos de programas\Ahead
2008-01-18 16:10:26 0 d-------- C:\Arquivos de programas\VIA
2008-01-18 14:58:55 0 d-------- C:\Documents and Settings\windows\Dados de aplicativos\Identities
2008-01-18 14:46:51 0 d-------- C:\Arquivos de programas\microsoft frontpage
2008-01-18 14:46:34 0 -rahs---- C:\MSDOS.SYS
2008-01-18 14:46:34 0 -rahs---- C:\IO.SYS
2008-01-18 14:46:34 0 --a------ C:\CONFIG.SYS
2008-01-18 14:46:34 0 --a------ C:\AUTOEXEC.BAT
2008-01-18 14:45:21 0 d--h----- C:\Arquivos de programas\WindowsUpdate
2008-01-18 14:45:17 0 d-------- C:\Arquivos de programas\Serviços on-line
2008-01-18 14:44:39 0 d-------- C:\Arquivos de programas\Arquivos comuns\Serviços
2008-01-18 14:44:36 0 d-------- C:\Arquivos de programas\Arquivos comuns\MSSoap
2008-01-18 14:44:29 0 d-------- C:\Arquivos de programas\Movie Maker
2008-01-18 14:43:45 21844 --a------ C:\WINDOWS\system32\emptyregdb.dat
2008-01-18 14:43:18 0 d-------- C:\Arquivos de programas\Messenger
2008-01-18 14:43:14 0 d-------- C:\Arquivos de programas\MSN Gaming Zone
2008-01-18 14:43:07 0 d-------- C:\Arquivos de programas\Windows NT
2008-01-18 12:26:01 0 d-------- C:\Arquivos de programas\Arquivos comuns\ODBC
2008-01-18 12:25:59 0 d-------- C:\Arquivos de programas\Arquivos comuns\SpeechEngines
2008-01-18 12:25:35 62 --ahs---- C:\Documents and Settings\windows\Dados de aplicativos\desktop.ini

-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6027FDCA-AE2C-438B-8535-3A96C154F97C}]
C:\WINDOWS\dgtxrdfqnt.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B5AF0562-94F3-42BD-F434-2604812C797D}]
2008-02-29 17:10 10000 --a------ C:\WINDOWS\system32\Fsd9mk4g.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C03FD59D-9104-44B7-929A-9EAA0BA05211}]
2008-02-29 17:21 12800 --a------ C:\Arquivos de programas\Helper\1204316496.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"NvCplDaemon "= "C:\WINDOWS\system32\NvCpl.dll" [2006-06-01 06:22]
"P17Helper "= "P17.dll" [2006-03-17 16:11 C:\WINDOWS\system32\P17.dll]
"NvMediaCenter "= "NvMCTray.dll" [2006-06-01 06:22 C:\WINDOWS\system32\nvmctray.dll]
"avast! "= "C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp. exe" [2007-12-04 11:00]
"QuickTime Task "= "C:\Arquivos de programas\QuickTime\qttask.exe" [2008-01-31 23:13]
"Adobe Reader Speed Launcher "= "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16]
"antiviirus "= "C:\Arquivos de programas\antiviirus.exe" [2008-02-29 17:05]
"advap32 "= "c:\74.tmp/r" []
"KernelFaultCheck "= "C:\WINDOWS\system32\dumpre p 0 -k" []
"autoload "= "C:\Documents and Settings\windows\Local Settings\Application Data\cftmon.exe" []
"ntuser "= "C:\WINDOWS\system32\drivers\spools.e xe" [2008-02-29 17:09]
"Streams Drivers "= "C:\WINDOWS\TEMP\services.exe" [2008-02-29 17:10]
"jkdfj94kgdftdf "= "C:\WINDOWS\TEMP\winlogan.exe " []
"Microsoft all "= "C:\WINDOWS\mmall.exe" [2008-02-29 17:18]
"Printer "= "C:\WINDOWS\system32\printer.exe" [2005-06-27 10:57]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"msnmsgr "= "C:\Arquivos de programas\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54]
"SVCHOST.EXE "= "C:\WINDOWS\system32\drivers\svchost .exe" []
"autoload "= "C:\Documents and Settings\windows\Local Settings\Application Data\cftmon.exe" []
"ntuser "= "C:\WINDOWS\system32\drivers\spools.e xe" [2008-02-29 17:09]
"Jnskdfmf9eldfd "= "C:\DOCUME~1\windows\CONFIG~1\Tem p\csrssc.exe" [2008-02-29 17:18]

[HKEY_USERS\.default\software\microsoft\windows\cur rentversion\run]
"autoload "=C:\Documents and Settings\LocalService\Local Settings\Application Data\cftmon.exe
"ntuser "=C:\WINDOWS\system32\drivers\spools.ex e
"jkdfj94kgdftdf "=C:\WINDOWS\TEMP\winlogan.exe
"Microsoft all "=C:\WINDOWS\mmall.exe
"Spoolsv "=C:\WINDOWS\system32\spoolvs.exe
C:\Documents and Settings\windows\Menu Iniciar\Programas\Inicializar\
HotSync Manager.lnk - C:\Arquivos de programas\Palm\HOTSYNC.EXE [2003-10-14 15:04:42]
PowerReg Scheduler.exe [2008-02-13 21:55:33]
C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\
autorun.exe [2005-06-27 10:57:36]
DataViz Messenger.lnk - C:\WINDOWS\DvzCommon\DvzMsgr.exe [2003-07-01 21:16:46]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system]
"DisableRegistryTools "=1 (0x1)
"DisableTaskMgr "=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\policies\system]
"DisableTaskMgr "=1 (0x1)
"DisableRegistryTools "=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\policies\explorer]
"NoFolderOptions "=1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\cur rentversion\policies\explorer]
"NoControlPanel "=1 (0x1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\SharedTaskScheduler]
"{B5AF0562-94F3-42BD-F434-2604812C797D} "= C:\WINDOWS\system32\Fsd9mk4g.dll [2008-02-29 17:10 10000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\ShellExecuteHooks]
"{E37CB5F0-51F5-4395-A808-5FA49E399F83} "= C:\ARQUIV~1\GbPlugin\gbieh.dll [2007-12-03 16:30 347976]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\ShellServiceObjectDelayLoad]
"alofkmn "= {96E9C49D-363E-45A2-848B-80D4DE41246B} - C:\WINDOWS\alofkmn.dll [2008-02-29 14:58 200704]
"bxlrvps "= {207F3F79-B240-47A3-88AE-217EEA62C0F8} - C:\WINDOWS\bxlrvps.dll [ ]
"WinAlrt "= {704550a0-0838-4631-9ae5-4d4f96b52d85} - C:\WINDOWS\Installer\{704550a0-0838-4631-9ae5-4d4f96b52d85}\WinAlrt.dll [2008-02-29 17:05 18562]
"zip "= {a7936ff6-f115-4767-9f1b-11ce699e314c} - C:\WINDOWS\Installer\{a7936ff6-f115-4767-9f1b-11ce699e314c}\zip.dll [2008-02-29 17:10 23142]
"RamBoot "= {615d9a82-a7fd-401b-9108-9e121447b2cf} - C:\WINDOWS\Installer\{615d9a82-a7fd-401b-9108-9e121447b2cf}\RamBoot.dll [2008-02-29 17:09 19226]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Shell "= "Explorer.exe C:\WINDOWS\shell.exe"
"Userinit "= "C:\WINDOWS\system32\userinit.exe,C:\WI NDOWS\TEMP\services.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginBb]
C:\ARQUIV~1\GbPlugin\gbieh.dll 2007-12-03 16:30 347976 C:\ARQUIV~1\GbPlugin\gbieh.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rpcc]
C:\WINDOWS\system32\rpcc.dll 2008-02-29 17:07 29696 C:\WINDOWS\system32\rpcc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WLCtrl32]
WLCtrl32.dll 2008-02-29 17:17 11776 C:\WINDOWS\system32\WLCtrl32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\Hxx45.sys]
@= "Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\PSEXESVC]
@= "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\System Reserved]
@= "Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\Vxu23.sys]
@= "Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage]
"C:\Arquivos de programas\AdVantage\AdVantage.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
C:\ARQUIV~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDAudDeck]
C:\Arquivos de programas\VIA\VIAudioi\HDADeck\HDeck.exe 1

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\K-Lite Nitro]
E:\K-LiteNitro\K-LiteNitro.exe /hide

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RunDLL32.exe NvMCTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\S3Trayp]
S3trayp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SW20]
C:\WINDOWS\system32\sw20.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SW24]
C:\WINDOWS\system32\sw24.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer]
VTTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinSys2]
C:\WINDOWS\system32\winsys2.exe

[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{1318fd9f-e210-11dc-b810-0040f4a45729}]
AutoRun\command- h.cmd
explore\Command- h.cmd
open\Command- h.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{19951aa2-c5fb-11dc-925e-001a4d990018}]
AutoRun\command- E:\INSTALAR.EXE /AUTORUN
configure\command- E:\INSTALAR.EXE
install\command- E:\INSTALAR.EXE
*Newly Created Service* - AVQ69
*Newly Created Service* - I2OMGMT

-- End of Deckard's System Scanner: finished at 2008-02-29 17:40:34 ------------

 

Hi renanqueiroz
Welcome to Windowsbbs.

Please post all logs asked for into this thread.

I will look over your logs shortly.

Geri

 

Hi

You have a big mess going here.

Your computer has multiple infections, including a backdoor. A backdoor gives intruders complete control of your computer, logs your keystrokes, steal personal information, etc.

This allows hackers to remotely control your computer, steal critical system information and Download and Execute files

If you do any financial dealings with this computer
I would suggest you change all passwords using a Non-infected computer (Not this one) and refrain from any credit card or financial dealings until clean. If you do any financial dealings with this computer Contact any credit card or banks for possible fraud on your account.


Though the Trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

When Should I Format, How Should I Reinstall

We can attempt to clean this machine but i can't guarantee that it will be 100% secure afterwards.

Should you have any questions, please feel free to ask.

Please let us know what you have decided to do in your next post.

Geri