shell.dll missing

JSantos · #1 (**permalink**) 09-10-2004, 02:46 AM

When I try to open one specific program, the message: shell.dll missing appear every time. I than copy shell.dll from the folder system to the folder system32 and the problem is temporary resolved. When I shut down and restart again... same problem

I already have the Spybot and the Ad-aware. Also I run CWShredder.

None resolved...

Finally I run HijackThis - I send you the log file.

Can you please help me?

Thanks.

Regards

Logfile of HijackThis v1.98.2
Scan saved at 2:38:42, on 09-10-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programas\Ficheiros comuns\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programas\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Programas\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\system32\javapd32.exe
C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\Programas\Apoint2K\Apoint.exe
C:\PROGRA~1\LAUNCH~1\QtaET2S.EXE
C:\Programas\Java\j2re1.4.2_03\bin\jusched.exe
C:\WINDOWS\system32\ieqt32.exe
C:\Programas\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programas\Ficheiros comuns\Symantec Shared\ccApp.exe
C:\Programas\Apoint2K\Apntex.exe
C:\Programas\WinZip\WZQKPICK.EXE
C:\Programas\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Programas\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Programas\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Programas\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Documents and Settings\Cliente\Os meus documentos\Os meus ficheiros recebidos\HijackThis.exe
C:\Programas\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\vwhkf.dll/sp.html#22776
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\jkjaw.dll/sp.html#22776
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://jkjaw.dll/index.html#22776
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://jkjaw.dll/index.html#22776
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\jkjaw.dll/sp.html#22776
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\vwhkf.dll/sp.html#22776
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\jkjaw.dll/sp.html#22776
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://jkjaw.dll/index.html#22776
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\vwhkf.dll/sp.html#22776
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\vwhkf.dll/sp.html#22776
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer disponibilizado por - Clix
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hiperligações
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {ABEE3A3C-3CE2-A44C-7A71-FE55BCC44985} - C:\WINDOWS\ntoi.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programas\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programas\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [Apoint] C:\Programas\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtaET2S.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programas\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [ieqt32.exe] C:\WINDOWS\system32\ieqt32.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programas\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ccApp] C:\Programas\Ficheiros comuns\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Programas\Ficheiros comuns\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [Ad-aware] "C:\PROGRA~1\LAVASOFT\AD-AWA~1\Ad-aware.exe" +c
O4 - HKLM\..\RunOnce: [winyt.exe] C:\WINDOWS\system32\winyt.exe
O4 - HKLM\..\RunOnce: [atlvg.exe] C:\WINDOWS\atlvg.exe
O4 - HKLM\..\RunOnce: [atlfg.exe] C:\WINDOWS\system32\atlfg.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Programas\Spyware Doctor\spydoctor.exe" /Q
O4 - Global Startup: Microsoft Office.lnk = C:\Programas\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programas\WinZip\WZQKPICK.EXE
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Programas\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\MSMSGS.EXE
O14 - IERESET.INF: START_PAGE_URL=http://www.clix.pt

owen · #2 (**permalink**) 09-10-2004, 09:40 PM

You have a Home Search infection. Please post a new Hijack This log along with the log needed in these instructions:

ActiveServices ...
- Please download GetService.zip
- Extract it to a new folder in the desktop. Double click on the Getservice.bat file to run it. This will create and open a text file named getservice.txt in the same folder. It will then open getservice.txt for you.
- getservice.txt will list all active Services. Copy and paste the contents of getservice.txt in your next reply here.

From the moment you post your list, until you see a detailed fix written up, DO NOT reboot your system or log off. If you do, the service will have changed and the fix provided will not work

JSantos · #3 (**permalink**) 10-10-2004, 11:19 AM

PsService v1.1 - local and remote services viewer/controller
Copyright (C) 2001-2003 Mark Russinovich
Sysinternals - www.sysinternals.com

SERVICE_NAME: Alerter
Notifica utilizadores e computadores seleccionados de alertas administrativos. Se este serviço estiver parado, os programas que utilizam alertas administrativos não os irão receber. Se este serviço estiver desactivado, quaisquer serviços que dependam dele explicitamente não serão iniciados.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 4 DISABLED
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Alerta
DEPENDENCIES : LanmanWorkstation
SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: ALG
Fornece suporte para plug-ins de protocolos de outros fabricantes para a 'Partilha de ligação à Internet' e o 'Firewall do Windows'.
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\alg.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Serviço de gateway de camada de aplicação
DEPENDENCIES :
SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: AppMgmt
Fornece serviços de instalação de software como, por exemplo, atribuir, publicar e remover.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Gestão de aplicações
DEPENDENCIES :
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: AudioSrv
Gere dispositivos de áudio para programas baseados no Windows. Se este serviço for parado, os efeitos e dispositivos de áudio não irão funcionar correctamente. Se este serviço for desactivado, o início dos serviços de que dependem explicitamente irá falhar.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP : AudioGroup
TAG : 0
DISPLAY_NAME : Áudio do Windows
DEPENDENCIES : PlugPlay
: RpcSs
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: BITS
Transfere ficheiros em fundo utilizando a largura de banda inactiva. Se este service for parado, funcionalidades tais como o Windows Update, e o MSN Explorer não conseguirão transferir automaticamente programas e outra informação. Se este serviço estiver desactivado, quaisquer serviços que dependam dele explicitamente podem não conseguir transferir ficheiros se não tiverem um mecanismo de protecção contra falhas para transferir ficheiros directamente através do IE caso BITS esteja desactivado.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Serviço de transferência inteligente em fundo
DEPENDENCIES : Rpcss
SERVICE_START_NAME: LocalSystem
FAIL_RESET_PERIOD : 0 seconds
FAILURE_ACTIONS : Restart DELAY: 60000 seconds
: Restart DELAY: 60000 seconds
: Restart DELAY: 60000 seconds

SERVICE_NAME: Browser
Mantém uma lista actualizada de computadores na rede e fornece-a aos computadores designados por browsers. Se este serviço estiver parado, esta lista não será actualizada ou mantida. Se este serviço estiver desactivado, quaisquer serviços que dependam dele explicitamente não serão iniciados.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Browser de computador
DEPENDENCIES : LanmanWorkstation
: LanmanServer
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: ccEvtMgr
Symantec Event Manager
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 0 IGNORE
BINARY_PATH_NAME : C:\Programas\Ficheiros comuns\Symantec Shared\ccEvtMgr.exe
LOAD_ORDER_GROUP : Symantec Services
TAG : 0
DISPLAY_NAME : Symantec Event Manager
DEPENDENCIES : RPCSS
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: ccPwdSvc
(null)
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 0 IGNORE
BINARY_PATH_NAME : C:\Programas\Ficheiros comuns\Symantec Shared\ccPwdSvc.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Symantec Password Validation Service
DEPENDENCIES :
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: CiSvc
Conteúdo de índices e propriedades de ficheiros em computadores locais e remotos; possibilita o rápido acesso a ficheiros através de uma linguagem de consulta flexível.

TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\system32\cisvc.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Serviço de indexação

DEPENDENCIES : RPCSS
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: ClipSrv
Permite que o 'Visualizador da área de armazenamento' armazene informações e as pçartilhe com computadores remotos. Se o serviço for parado, o 'Visualizador da área de armazenamento' não poderá partilhar informações com computadores remotos. Se este serviço for desactivado, a inicialização dos serviços dependentes dele explicitamente falhará.
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 4 DISABLED
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\system32\clipsrv.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : ClipBook
DEPENDENCIES : NetDDE
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: COMSysApp
Gere a configuração e o controlo de componentes baseados no Component Object Model (COM)+. Se este serviço for parado, a maior parte dos componentes baseados no COM+ não funcionará correctamente. Se este serviço for desactivado, quaisquer serviços que dependam explicitamente dele não conseguirão ser inicializados.
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Aplicação de sistema COM+
DEPENDENCIES : rpcss
SERVICE_START_NAME: LocalSystem
FAIL_RESET_PERIOD : 30 seconds
FAILURE_ACTIONS : Restart DELAY: 1000 seconds
: Restart DELAY: 5000 seconds
: None DELAY: 1000 seconds

SERVICE_NAME: CryptSvc
Fornece três serviços de gestão: 'Serviço de catalogação de bases de dados', que confirma as assinaturas de ficheiros do Windows; 'Serviço de protecção de raiz', que adiciona e remove certificados de 'Autoridade de certificação de raiz fiável' deste computador e o 'Serviço de chaves' que ajuda a inscrever este computador para certificados. Se este serviço for parado, estes serviços de gestão não irão funcionar correctamente. Se este serviço estiver desactivado, quaisquer serviços que dependam dele explicitamente não irão iniciar correctamente.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Serviços criptográficos
DEPENDENCIES : RpcSs
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: DcomLaunch
Fornece funcionalidade de lançamento para serviços DCOM.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\system32\svchost -k DcomLaunch
LOAD_ORDER_GROUP : Event Log
TAG : 0
DISPLAY_NAME : DCOM - Lançador de processo de servidor
DEPENDENCIES :
SERVICE_START_NAME: LocalSystem
FAIL_RESET_PERIOD : 0 seconds
FAILURE_ACTIONS : Reboot DELAY: 60000 seconds

SERVICE_NAME: Dhcp
Gere a configuração da rede registando e actualizando endereços IP e nomes DNS.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP : TDI
TAG : 0
DISPLAY_NAME : Cliente DHCP
DEPENDENCIES : Tcpip
: Afd
: NetBT
: SYMTDI
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: dmadmin
Configura unidades e volumes de disco rígido. O serviço só é executado para processos de configuração e depois pára.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\dmadmin.exe /com
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Serviço administrativo de gestão de discos lógicos
DEPENDENCIES : RpcSs
: PlugPlay
: DmServer
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: dmserver
Detecta e supervisiona as novas unidades de discos e envia informações sobre o volume de discos para o serviço administrativo de gestão de discos lógicos para configuração. Se este serviço for parado, as informações de estado de discos dinâmicos e de configuração podem ficar desactualizadas. Se este serviço for desactivado, a inicialização dos serviços dependentes dele explicitamente falhará.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Gestor de discos lógicos
DEPENDENCIES : RpcSs
: PlugPlay
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Dnscache
Resolve e coloca na cache os nomes DNS (Domain Name System) para este computador. Se este serviço estiver parado, este computador não será capaz de resolver os nomes de DNS e localizar os controladores de domínio Active Directory. Se este serviço estiver desactivado, quaisquer serviços que dependam dele explicitamente não serão iniciados.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k NetworkService
LOAD_ORDER_GROUP : TDI
TAG : 0
DISPLAY_NAME : Cliente DNS
DEPENDENCIES : Tcpip
SERVICE_START_NAME: NT AUTHORITY\NetworkService

SERVICE_NAME: ERSvc
Permite o relato de erros para serviços e aplicações a serem executados em ambientes não padrão.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 0 IGNORE
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Serviço de relato de erros
DEPENDENCIES : RpcSs
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Eventlog
Activa mensagens do registo de eventos emitidas por programas baseados no Windows e componentes a apresentar no 'Visualizador de eventos'. Este serviço não pode ser parado.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\system32\services.exe
LOAD_ORDER_GROUP : Event log
TAG : 0
DISPLAY_NAME : Registo de eventos
DEPENDENCIES :
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: EventSystem
Suporta o serviço de notificação de eventos do sistema (SENS), que fornece a distribuição automática de eventos para subscrever componentes Component Object Model (COM). Se o serviço for parado, o SENS será encerrado e não poderá fornecer notificações de início e de fim de sessão. Se este serviço for desactivado, quaisquer serviços que dependam explicitamente do mesmo não conseguirão ser inicializados.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP : Network
TAG : 0
DISPLAY_NAME : Sistema de eventos do COM+
DEPENDENCIES : RPCSS
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: FastUserSwitchingCompatibility
Fornece a gestão para as aplicações que requerem assistência num ambiente de vários utilizadores.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Compatibilidade de 'Mudança rápida de utilizador'
DEPENDENCIES : TermService
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Fax
Permite-lhe enviar e receber faxes, utilizando os recursos de fax disponíveis neste computador ou na rede.
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\system32\fxssvc.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Fax
DEPENDENCIES : TapiSrv
: RpcSs
: PlugPlay
: Spooler
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: helpsvc
Activa o Centro de ajuda e suporte para ser executado neste computador. Se este serviço for parado, o Centro de ajuda e suporte não estará disponível. Se este serviço estiver desactivado, todos os serviços que dependem explicitamente dele não vão iniciar.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Ajuda e suporte
DEPENDENCIES : RPCSS
SERVICE_START_NAME: LocalSystem
FAIL_RESET_PERIOD : 86400 seconds
FAILURE_ACTIONS : Restart DELAY: 100 seconds
: Restart DELAY: 100 seconds
: None DELAY: 100 seconds

SERVICE_NAME: HidServ
Fornece acesso por entrada genérica a dispositivos de interface humana (HID), que activa e mantém a utilização de botões de acesso directo em teclados, controlos remotos e outros dispositivos de multimédia. Se este serviço for parado, os botões de acesso directo controlados por este serviço deixarão de funcionar. Se este serviço for desactivado, a inicialização dos serviços dependentes dele explicitamente falhará.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 4 DISABLED
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Acesso a dispositivos de interface humana
DEPENDENCIES : RpcSs
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: HTTPFilter
Este serviço implementa o protocolo de transferência de hipertexto seguro (HTTPS) do serviço HTTP, utilizando SSL (Secure Socket Layer). Se este serviço for desactivado, quaisquer serviços que dependam explicitamente dele não serão iniciados.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k HTTPFilter
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : SSL de HTTP
DEPENDENCIES : HTTP
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: ImapiService
Gere a gravação de CD utilizando a IMAPI (Image Mastering Applications Programming Interface). Se este serviço for parado, este computador não conseguirá gravar CDs. Se este serviço estiver desactivado, quaisquer serviços que dependam explicitamente do mesmo não conseguirão ser iniciados.
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\imapi.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Serviço COM de gravação de CD de IMAPI
DEPENDENCIES :
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: lanmanserver
Suporta a partilha de ficheiros, de impressão e de pipes com nome sobre a rede para este computador. Se este serviço estiver parado, estas funções não estarão disponíveis. Se este serviço estiver desactivado, quaisquer serviços que dependam dele explicitamente não serão iniciados.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Servidor
DEPENDENCIES :
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: lanmanworkstation
Cria e mantém clinte de ligações de rede a servidores remotos. Se este serviço estiver parado, estas ligações estarão indisponíveis. Se este serviço estiver desactivado, quaisquer serviços que dependam dele explicitamente não serão iniciados.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP : NetworkProvider
TAG : 0
DISPLAY_NAME : Estação de trabalho
DEPENDENCIES :
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: LmHosts
Activa o suporte para o serviço NetBIOS em TCP/IP (NetBT) e para a resolução de nomes NetBIOS.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService
LOAD_ORDER_GROUP : TDI
TAG : 0
DISPLAY_NAME : Programa auxiliar TCP/IP NetBIOS
DEPENDENCIES : NetBT
: Afd
SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: Messenger
Envia mensagens de serviço de 'Alerter' e 'net send' entre clientes e servidores. Este serviço não está relacionado com o Windows Messenger. Se este serviço estiver parado, as mensagens de 'Alerter' não serão enviadas. Se este serviço estiver desactrivado, quaisquer serviços que dependam dele explicitamente não serão iniciados.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 4 DISABLED
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Mensageiro
DEPENDENCIES : LanmanWorkstation
: NetBIOS
: PlugPlay
: RpcSS
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: mnmsrvc
Permite às pessoas autorizadas aceder remotamente ao seu ambiente de trabalho do Windows utilizando o NetMeeting.
TYPE : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\mnmsrvc.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Partilha remota do ambiente de trabalho do NetMeeting
DEPENDENCIES :
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: MSDTC
Coordena transacções que expandem vários gestores de recursos, tais como bases de dados, filas de mensagens e sistemas de ficheiros. Se este serviço for parado, estas transacções não ocorrerão. Se este serviço estiver desactivado, quaisquer serviços que dependam explicitamente do mesmo vão falhar.
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\msdtc.exe
LOAD_ORDER_GROUP : MS Transactions
TAG : 0
DISPLAY_NAME : DTC (Coordenador de transacções distribuídas)
DEPENDENCIES : RPCSS
: SamSS
SERVICE_START_NAME: NT Authority\NetworkService

SERVICE_NAME: MSIServer
Adiciona, modifica e remove aplicações fornecidas como um pacote Windows Installer (*.msi). Se este serviço estiver desactivado, todos os serviços que dependam expressamente dele para iniciar não serão iniciados.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\msiexec.exe /V
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Windows Installer
DEPENDENCIES : RpcSs
SERVICE_START_NAME: LocalSystem

(...) Continues on the next post

JSantos · #4 (**permalink**) 10-10-2004, 11:20 AM

(...) Continuing...

SERVICE_NAME: navapsvc
Handles Norton AntiVirus Auto-Protect events.
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : "C:\Programas\Norton SystemWorks\Norton AntiVirus\navapsvc.exe"
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Norton AntiVirus Auto Protect Service
DEPENDENCIES : RPCSS
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: NetDDE
Fornece transporte e segurança de rede para intercâmbio dinâmico de dados (DDE) para programas em execução no mesmo computador ou em computadores diferentes. Se este serviço for parado, o transporte e segurança de DDE não estarão disponíveis. Se este serviço for desactivado, a inicialização dos serviços dependentes dele explicitamente falhará.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 4 DISABLED
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\system32\netdde.exe
LOAD_ORDER_GROUP : NetDDEGroup
TAG : 0
DISPLAY_NAME : Rede DDE
DEPENDENCIES : NetDDEDSDM
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: NetDDEdsdm
Gere partilhas de rede de intercâmbio dinâmico de dados (DDE). Se este serviço for parado, as partilhas de rede DDE não estarão disponíveis. Se este serviço for desactivado, a inicialização dos serviços dependentes dele explicitamente falhará.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 4 DISABLED
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\system32\netdde.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Rede DDE DSDM
DEPENDENCIES :
: EGrLocalSystem
: Rede DDE DSDM
: m
: Rede DDE
: ocalSystem
: Norton AntiVirus Auto Protect Service
: stribuídas)
: \Cd
:
: ‘
:
: ˜6
: ˜6
: partilhas de rede de intercâmbio dinâmico de dados (DDE). Se este serviço for parado, as partilhas de rede DDE não estarão disponíveis. Se este serviço for desactivado, a inicialização dos serviços dependentes dele explicitamente falhará.
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Netlogon
Suporta a autenticação pass-through dos eventos de início de sessão de conta para os computadores num domínio.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\lsass.exe
LOAD_ORDER_GROUP : RemoteValidation
TAG : 0
DISPLAY_NAME : Início de sessão de rede
DEPENDENCIES : LanmanWorkstation
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Netman
Gere objectos na pasta 'Ligações de acesso telefónico e de rede', na qual pode ver os locais das ligações da área da rede local e remota.
TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Ligações de rede
DEPENDENCIES : RpcSs
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Nla
Recolhe e armazena informações de configuração e localizações da rede e notifica as aplicações quando estas informações são alteradas.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Identificação da localização na rede (NLA)
DEPENDENCIES : Tcpip
: Afd
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: NProtectService
(null)
TYPE : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : "C:\Programas\Norton SystemWorks\Norton Utilities\NPROTECT.EXE"
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Norton Unerase Protection
DEPENDENCIES :
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: NtLmSsp
Fornece segurança a programas de chamada de procedimento remoto (RPC) que utilizam transportes que não sejam pipes nomeados.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\lsass.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : NT LM Security Support Provider
DEPENDENCIES :
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: NtmsSvc
(null)
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Armazenamento amovível
DEPENDENCIES : RpcSs
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: O?’ŽrtñåÈ²$Ó
(null)
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 0 IGNORE
BINARY_PATH_NAME : C:\WINDOWS\system32\javapd32.exe /s
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Network Security Service
DEPENDENCIES :
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: PlugPlay
Permite que um computador identifique e se adapte a alterações de hardware com pouca ou nenhuma interactividade do utilizador. A paragem ou desactivação deste serviço resultará na instabilidade do sistema.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\system32\services.exe
LOAD_ORDER_GROUP : PlugPlay
TAG : 0
DISPLAY_NAME : Plug and Play
DEPENDENCIES :
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Pml Driver HPZ12
(null)
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\HPZipm12.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Pml Driver HPZ12
DEPENDENCIES :
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: PolicyAgent
Gere a política de segurança IP e inicia o ISAKMP/Oakley (IKE) e o controlador de segurança IP.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\lsass.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Serviços IPSEC
DEPENDENCIES : RPCSS
: Tcpip
: IPSec
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: ProtectedStorage
Fornece armazenamento para dados importantes como, por exemplo, chaves privadas, de forma a impedir o acesso de serviços, processos ou utilizadores não autorizados.
TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\system32\lsass.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Armazenamento protegido
DEPENDENCIES : RpcSs
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: RasAuto
Cria uma ligação a uma rede remota sempre que um programa referencia um DNS remoto, ou um nome ou endereço NetBIOS.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Gestor de ligação automática de acesso remoto
DEPENDENCIES : RasMan
: Tapisrv
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: RasMan
Cria uma ligação de rede.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Gestor de ligação de acesso remoto
DEPENDENCIES : Tapisrv
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: RDSessMgr
Gere e controla a 'Assistência remota'. Se este serviço for parado, a 'Assistência remota' não irá estar disponível. Antes de parar este serviço, consulte o separador 'Dependências' da caixa de diálogo 'Propriedades'.
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\system32\sessmgr.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Gestor de sessões de ajuda do 'Ambiente de trabalho remoto'
DEPENDENCIES : RPCSS
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: RemoteAccess
Disponibiliza serviços de encaminhamento a empresas em ambientes de rede local e alargada.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 4 DISABLED
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Encaminhamento e acesso remoto
DEPENDENCIES : RpcSS
: +NetBIOSGroup
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: RpcLocator
Gere a base de dados de serviço de nomes de RPC.
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\locator.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Localizador RPC (Remote Procedure Call)
DEPENDENCIES : LanmanWorkstation
SERVICE_START_NAME: NT AUTHORITY\NetworkService

SERVICE_NAME: RpcSs
Fornece um mapeador de pontos finais e outros serviços RPC.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\system32\svchost -k rpcss
LOAD_ORDER_GROUP : COM Infrastructure
TAG : 0
DISPLAY_NAME : Chamada de procedimento remoto (RPC)
DEPENDENCIES :
SERVICE_START_NAME: NT Authority\NetworkService
FAIL_RESET_PERIOD : 0 seconds
FAILURE_ACTIONS : Reboot DELAY: 60000 seconds

SERVICE_NAME: RSVP
Fornece a sinalização de rede e a função de configuração de controlo do trânsito local para programas que utilizem QoS e aplicações de controlo.
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\rsvp.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : QoS RSVP
DEPENDENCIES : TcpIp
: Afd
: RpcSs
SERVICE_START_NAME: LocalSystem

(...) Continues on the next post...

JSantos · #5 (**permalink**) 10-10-2004, 11:21 AM

(...) Continuing

SERVICE_NAME: SamSs
Armazena as informações de segurança para as contas de utilizador locais.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\system32\lsass.exe
LOAD_ORDER_GROUP : LocalValidation
TAG : 0
DISPLAY_NAME : Gestor de contas de segurança
DEPENDENCIES : RPCSS
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SBService
(null)
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\PROGRA~1\FICHEI~1\SYMANT~1\SCRIPT~1\SBServ.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : ScriptBlocking Service
DEPENDENCIES :
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SCardSvr
Gere o acesso a smart cards lidas pelo computador. Se parar este serviço, não será possível a este computador ler smart cards. Se este serviço for desactivado, não será possível iniciar quaisquer serviços que dele dependam explicitamente.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 0 IGNORE
BINARY_PATH_NAME : C:\WINDOWS\System32\SCardSvr.exe
LOAD_ORDER_GROUP : SmartCardGroup
TAG : 0
DISPLAY_NAME : Smart Card
DEPENDENCIES : PlugPlay
SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: Schedule
Permite a utilizador configurar e agendar tarefas automatizadas neste computador. Se este serviço estiver parado, estas tarefas não serão executadas nas horas agendadas. Se este serviço estiver desactivado, qualquer serviço que dependa explicitamente dele não será inciado.
TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP : SchedulerGroup
TAG : 0
DISPLAY_NAME : Programador de tarefas
DEPENDENCIES : RpcSs
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: seclogon
Activa processos de início sob credenciais alternativas. Se parar este serviço, este tipo de acesso de início de sessão estará indisponível. Se este serviço for desactivado, quaisquer serviços que dele dependem explicitamente falharão ao iniciar.
TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 0 IGNORE
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Início de sessão secundário
DEPENDENCIES :
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SENS
Regista os eventos do sistema como, por exemplo, início de sessão do Windows, rede e eventos de alimentação. Notifica os subscritores do sistema de eventos COM+ desses eventos.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP : Network
TAG : 0
DISPLAY_NAME : Notificação de evento de sistema
DEPENDENCIES : EventSystem
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SharedAccess
Fornece conversão de endereços de rede, endereçamento, resolução de nomes e/ou serviços de prevenção de intrusões para uma rede de pequeno escritório ou doméstica.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Firewall do Windows/Partilha de ligação à Internet (ICS)
DEPENDENCIES : Netman
: WinMgmt
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: ShellHWDetection
(null)
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 0 IGNORE
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP : ShellSvcGroup
TAG : 0
DISPLAY_NAME : Detecção de hadrware da shell
DEPENDENCIES : RpcSs
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Speed Disk service
(null)
TYPE : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 0 IGNORE
BINARY_PATH_NAME : C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Speed Disk service
DEPENDENCIES : RPCSS
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Spooler
Carrega ficheiros para a memória para imprimir mais tarde.
TYPE : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\system32\spoolsv.exe
LOAD_ORDER_GROUP : SpoolerGroup
TAG : 0
DISPLAY_NAME : Spooler de impressão
DEPENDENCIES : RPCSS
SERVICE_START_NAME: LocalSystem
FAIL_RESET_PERIOD : 86400 seconds
FAILURE_ACTIONS : Restart DELAY: 60000 seconds
: Restart DELAY: 60000 seconds
: None DELAY: 0 seconds

SERVICE_NAME: srservice
Executa funções de restauro do sistema. Para parar o serviço, desactive a opção 'Restauro do sistema' a partir do separador 'Restauro do sistema' em 'O meu computador'->'Propriedades'
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Serviço de 'Restauro do sistema'
DEPENDENCIES : RpcSs
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SSDPSRV
Permite a identificação de dispositivos UPnP na rede doméstica.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Serviço de identificação SSDP
DEPENDENCIES : HTTP
SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: stisvc
Fornece serviços de aquisição de imagem para scanners e câmaras.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k imgsvc
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Windows Image Acquisition (WIA)
DEPENDENCIES : RpcSs
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SwPrv
Gere cópias sombra baseadas em software criadas pelo serviço de cópia sombra de volumes. Se este serviço for parado, não é possível gerir as cópias sombra baseados em software. Se este serviço for desactivado, quaisquer serviços que dependam explicitamente dele não conseguirão arrancar.
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 0 IGNORE
BINARY_PATH_NAME : C:\WINDOWS\System32\dllhost.exe /Processid:{401B858D-7085-4244-B515-FB5B925ACA59}
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : MS Software Shadow Copy Provider
DEPENDENCIES : rpcss
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SysmonLog
Recolhe dados de desempenho de computadores locais ou remotos baseados em parâmetros de agendamento pré-configurados e, em seguida, grava os dados num registo ou activa um alerta. Se este serviço for parado, as informações de desempenho não serão recolhidas. Se este serviço for desactivado, os serviços que dependem explicitamente dele não serão iniciados.
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\system32\smlogsvc.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Alertas e registos de desempenho
DEPENDENCIES :
SERVICE_START_NAME: NT Authority\NetworkService

SERVICE_NAME: TapiSrv
Fornece suporte de Telephony API (TAPI) para programas que controlam dispositivos telefónicos e ligações de voz com base em IP no computador local e através da rede local em servidores com o serviço em execução.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Dispositivos telefónicos
DEPENDENCIES : PlugPlay
: RpcSs
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: TermService
Permite a múltiplos utilizadores estarem ligados interactivamente a um computador bem como mostrar os ambientes de trabalho e aplicações a computadores remotos. É o que está por detrás do 'Ambiente de trabalho remoto' (incluindo RD para administradores), 'Mudança rápida de utilizador', 'Assistência remota' e 'Servidor de terminais'.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost -k DComLaunch
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Serviços de terminal
DEPENDENCIES : RPCSS
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Themes
Fornece a gestão de temas por parte dos utilizadores.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP : UIGroup
TAG : 0
DISPLAY_NAME : Temas
DEPENDENCIES :
SERVICE_START_NAME: LocalSystem
FAIL_RESET_PERIOD : 86400 seconds
FAILURE_ACTIONS : Restart DELAY: 60000 seconds
: Restart DELAY: 60000 seconds
: None DELAY: 0 seconds

SERVICE_NAME: TrkWks
Mantém hiperligações entre ficheiros NTFS num computador ou em vários computadores num domínio de rede.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Cliente de Distributed Link Tracking
DEPENDENCIES : RpcSs
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: upnphost
Fornece suporte para hospedar dispositivos Universal Plug and Play.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Anfitrião de dispositivos Universal Plug and Play
DEPENDENCIES : SSDPSRV
: HTTP
SERVICE_START_NAME: NT AUTHORITY\LocalService
FAIL_RESET_PERIOD : -1 seconds
FAILURE_ACTIONS : Restart DELAY: 0 seconds

SERVICE_NAME: UPS
Gere uma fonte de alimentação ininterrupta (UPS) ligada ao computador.
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\ups.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Fonte de alimentação ininterrupta
DEPENDENCIES :
SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: vsmon
Monitors internet traffic and generates alerts for disallowed access.
TYPE : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\system32\ZONELABS\vsmon.exe -service
LOAD_ORDER_GROUP : TrueVector Group
TAG : 0
DISPLAY_NAME : TrueVector Internet Monitor
DEPENDENCIES : Afd
: RpcSs
: vsdatant
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: VSS
Gere e implementa cópias de mirror de volume utilizadas para cópia de segurança, entre outros propósitos. Se este serviço for parado, as cópias de mirror não estarão disponíveis para cópia de segurança e esta poderá falhar. Se este serviço estiver desactivado, não será possível iniciar qualquer serviço que dependa explicitamente dele.
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\vssvc.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Cópia sombra de volume
DEPENDENCIES : RPCSS
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: W32Time
Gere a sincronização da data e da hora de todos clientes e servidores na rede. Se este serviço parar, a sincronização de data e hora deixará de estar disponível. Se este serviço estiver desactivado, não será possível iniciar quaisquer serviços que dependam explicitamente dele.

TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Hora do Windows
DEPENDENCIES :
SERVICE_START_NAME: LocalSystem
FAIL_RESET_PERIOD : 5 seconds
FAILURE_ACTIONS : Restart DELAY: 60000 seconds
: Restart DELAY: 60000 seconds

SERVICE_NAME: WebClient
Permite que os programas baseados no Windows criem, acedam e modifiquem ficheiros baseados na Internet. Se este serviço estiver parado, estas funções não estarão disponíveis. Se este serviço estiver desactivado, qualquer serviço que dependa explicitamente dele não será inciado.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService
LOAD_ORDER_GROUP : NetworkProvider
TAG : 0
DISPLAY_NAME : WebClient
DEPENDENCIES : MRxDAV
SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: winmgmt
Fornece uma interface comum e modelo de objecto para aceder a informação de gestão de acesso acerca do sistema operativo, dispositivos, aplicações e serviços. Se este serviço for parado, a maioria do software baseado em Windows não irá funcionar correctamente. Se este serviço estiver desactivado, quaisquer serviços que dependam explicitamente dele não conseguirão iniciar.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 0 IGNORE
BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : WMI (Instrumento de gestão do Windows)
DEPENDENCIES : RPCSS
: Eventlog
SERVICE_START_NAME: LocalSystem
FAIL_RESET_PERIOD : 86400 seconds
FAILURE_ACTIONS : Restart DELAY: 60000 seconds
: Restart DELAY: 60000 seconds

SERVICE_NAME: WmdmPmSN
Obtém o número de série de qualquer leitor de multimédia portátil ligado a este computador. Se este serviço for interrompido, poderá não conseguir transferir conteúdo protegido para o dispositivo.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Serviço do número de série de leitores de multimédia portáteis
DEPENDENCIES :
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: WmiApSrv
Fornece informações de biblioteca de desempenho a partir de fornecedores HiPerf de WMI.
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\wbem\wmiapsrv.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Adaptador de desempenho WMI
DEPENDENCIES : RPCSS
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: wscsvc
Monitoriza configurações e definições de segurança do sistema
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Centro de segurança
DEPENDENCIES : RpcSs
: winmgmt
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: wuauserv
Permite a transferência e instalação de actualizações do Windows. Se este serviço estiver desactivado, este computador não conseguirá utilizar a funcionalidade de actualizações automáticas nem o website Windows Update.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Actualizações automáticas
DEPENDENCIES :
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: WZCSVC
Fornece configuração automática aos adaptadores 802.11
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP : TDI
TAG : 0
DISPLAY_NAME : Configuração zero sem fios
DEPENDENCIES : RpcSs
: Ndisuio
SERVICE_START_NAME: LocalSystem

SERVICE_NAME: xmlprov
Gere ficheiros de configuração de XML com base no domínio para fornecimento de rede automáticas.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Serviço de fornecimento de rede
DEPENDENCIES : RpcSs
SERVICE_START_NAME: LocalSystem

End.

JSantos · #6 (**permalink**) 10-10-2004, 07:18 PM

Sorry, I forgot to put the hijackThis log...

There it is...

Thank you!

Logfile of HijackThis v1.98.2
Scan saved at 20:03:59, on 10-10-2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programas\Ficheiros comuns\Symantec Shared\ccEvtMgr.exe
C:\Programas\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Programas\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\system32\javapd32.exe
C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Programas\Apoint2K\Apoint.exe
C:\PROGRA~1\LAUNCH~1\QtaET2S.EXE
C:\Programas\Java\j2re1.4.2_03\bin\jusched.exe
C:\WINDOWS\system32\ieqt32.exe
C:\Programas\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programas\Ficheiros comuns\Symantec Shared\ccApp.exe
C:\Programas\Spyware Doctor\spydoctor.exe
C:\Programas\Apoint2K\Apntex.exe
C:\Programas\WinZip\WZQKPICK.EXE
C:\Programas\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Programas\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Programas\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Programas\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Programas\Internet Explorer\iexplore.exe
C:\Programas\Internet Explorer\iexplore.exe
C:\Programas\Messenger\msmsgs.exe
C:\Documents and Settings\Cliente\Os meus documentos\Os meus ficheiros recebidos\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\lznby.dll/sp.html#22776
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\dfkyo.dll/sp.html#22776
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://dfkyo.dll/index.html#22776
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://dfkyo.dll/index.html#22776
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\dfkyo.dll/sp.html#22776
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\lznby.dll/sp.html#22776
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\dfkyo.dll/sp.html#22776
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://dfkyo.dll/index.html#22776
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\lznby.dll/sp.html#22776
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\lznby.dll/sp.html#22776
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer disponibilizado por - Clix
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hiperligações
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {2B4D7BB4-8681-4CA0-C521-E8676541199C} - C:\WINDOWS\ipea32.dll
O2 - BHO: (no name) - {ABEE3A3C-3CE2-A44C-7A71-FE55BCC44985} - C:\WINDOWS\ntoi.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programas\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programas\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [Apoint] C:\Programas\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtaET2S.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programas\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [ieqt32.exe] C:\WINDOWS\system32\ieqt32.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programas\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ccApp] C:\Programas\Ficheiros comuns\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Programas\Ficheiros comuns\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [Ad-aware] "C:\PROGRA~1\LAVASOFT\AD-AWA~1\Ad-aware.exe" +c
O4 - HKLM\..\RunOnce: [winyt.exe] C:\WINDOWS\system32\winyt.exe
O4 - HKLM\..\RunOnce: [atlvg.exe] C:\WINDOWS\atlvg.exe
O4 - HKLM\..\RunOnce: [atlfg.exe] C:\WINDOWS\system32\atlfg.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Programas\Spyware Doctor\spydoctor.exe" /Q
O4 - Global Startup: Microsoft Office.lnk = C:\Programas\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programas\WinZip\WZQKPICK.EXE
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Programas\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.clix.pt

owen · #7 (**permalink**) 10-10-2004, 09:55 PM

Download AboutBuster. Unzip it to c:\aboutbuster but don't run it yet we'll do that later on down in this list in SAFE MODE.
Print out these instructions so you have them handy as some of the steps need to be done in safe mode and you may not be able to go online. We need IE to remain closed throughout the process. With that in mind, read through the instructions and download all necessary files ahead of time. Opening IE may cause the fix to fail
Make sure your PC is configured to show hidden files. Open Windows Explorer & Go to "Tools" => "Folder Options". Click on the "View" tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types". Now click "Apply to all folders". Click "Apply" then "OK"
Reboot to Safe Mode => How do I boot into safe mode?
Next, go to Start => Run and type "Services.msc" (without quotes) then hit Ok. Scroll down and find the service called
- Network Security Service
When you find it, double-click on it. In the next window that opens, click the Stop button, then click on properties and under the General Tab, change the Startup Type to Disabled. Now hit Apply and then Ok and close any open windows.
Press control-alt-delete to get into the task manager and end the follow processes if they exist:
- javapd32.exe
Run HijackThis and put checks next to all the following, then click "Fix Checked":
- R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\lznby.dll/sp.html#22776
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\dfkyo.dll/sp.html#22776
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://dfkyo.dll/index.html#22776
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://dfkyo.dll/index.html#22776
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\dfkyo.dll/sp.html#22776
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\lznby.dll/sp.html#22776
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\dfkyo.dll/sp.html#22776
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://dfkyo.dll/index.html#22776
  R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\lznby.dll/sp.html#22776
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\lznby.dll/sp.html#22776
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer disponibilizado por - Clix
  R3 - Default URLSearchHook is missing
  O2 - BHO: (no name) - {2B4D7BB4-8681-4CA0-C521-E8676541199C} - C:\WINDOWS\ipea32.dll
  O2 - BHO: (no name) - {ABEE3A3C-3CE2-A44C-7A71-FE55BCC44985} - C:\WINDOWS\ntoi.dll
  O4 - HKLM\..\Run: [ieqt32.exe] C:\WINDOWS\system32\ieqt32.exe
  O4 - HKLM\..\RunOnce: [winyt.exe] C:\WINDOWS\system32\winyt.exe
  O4 - HKLM\..\RunOnce: [atlvg.exe] C:\WINDOWS\atlvg.exe
  O4 - HKLM\..\RunOnce: [atlfg.exe] C:\WINDOWS\system32\atlfg.exe
Delete the following files if present (If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. if it is uncheck it and try again.):
- C:\WINDOWS\ipea32.dll
  C:\WINDOWS\ntoi.dll
  C:\WINDOWS\system32\ieqt32.exe
  C:\WINDOWS\system32\winyt.exe
  C:\WINDOWS\atlvg.exe
  C:\WINDOWS\system32\atlfg.exe
Next, we will remove the offending service.
1. Go to "Start" => "Run" and type in regedit and press "Enter".
2. Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\O?’ŽrtñåÈ²$Ó.
3. If O?’ŽrtñåÈ²$Ó exists , right click on it and choose delete from the menu.
4. Now navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\R oot\LEGACY_O?’ŽrtñåÈ²$Ó
5. If LEGACY_O?’ŽrtñåÈ²$Ó exists then right click on it and choose delete from the menu.
6. If you have trouble deleting a key. Then click once on the key name to highlight it and click on the Permission menu option under Security or Edit. Then Uncheck "Allow inheritible permissions" and press copy. Then click on everyone and put a checkmark in "full control". Then press apply and ok and attempt to delete the key again.
Browse to c:\aboutbusterand double click on aboutbuster.exe. When the tool is open press the OK button, then the Start button, then the OK button, and then finally the Yes button. It will start scanning your computer for files. If it asks if you would like to do a second pass, allow it to do so.When finished, press the "Save log" button. I will want a copy of that log after all steps are completed here.
Copy the contents of the Quote Box below (Listed after all steps) to Notepad. Name the file as fix.reg. Change the Save as Type to All Files. Save this file on the desktop
Then double-click on the fix.reg file, and when it prompts to merge say yes, and this will clear some registry entries left behind by the process.
Run Ad-Aware with the latest update.
1. Download the latest version of Ad-Aware (Ad-Aware SE Build 1.03) from here.
2. If you have a previous version of Ad-Aware installed, during the installation of the new version you will be prompted to uninstall or keep the older version - be sure to uninstall the previous version.
3. After installing Ad-aware, you will be prompted to update the program and run a full scan. De-select all boxes so that it does not run.
4. Manually run "Ad-Aware SE Personal" and from the main screen Click on "Check for Updates Now".
5. Once the definitions have been updated:
6. Reconfigure Ad-Aware for Full Scan as per the following instructions:
  - Launch the program, and click on the Gear at the top of the start screen.
  - Under General Settings the following boxes should all be checked off: (Checked will be indicated by a green circle with a check mark in it, Un-Checked is a red circle with an X in it. If it is greyed out, those features are only available in the retail version.)
    - "Automatically save logfile"
    - Automatically quarrantine objects prior to removal"
    - Safe Mode (always request confirmation)
    - Prompt to update outdated confirmation) - Change to 7 days.
  - Click the "Scanning" button (On the left side).
  - Under Drives & Folders, select "Scan within Archives"
  - Click "Click here to select Drives + folders" and select your installed hard drives.
  - Under Memory & Registry, select all options.
  - Click the "Advanced" button (On the left hand side).
  - Under "Shell Integration", select "Move deleted files to Recycle Bin".
  - Under "Log-file detail", select all options.
  - Click on the "Defaults" button on the left.
  - Type in the full url of what you want as your default homepage and searchpage e.g. http://www.google.com.
  - Click the "Tweak" button (Again, on the left hand side).
  - Expand "Scanning Engine" by clicking on the "+" (Plus) symbol) and select the following:
    - "Unload recognized processes during scanning."
    - "Obtain command line of scanned processes"
    - "Scan registry for all users instead of current user only"
  - Under "Cleaning Engine", select the following:
    - "Automatically try to unregister objects prior to deletion."
    - "During removal, unload explorer and IE if necessary"
    - "Let Windows remove files in use at next reboot."
    - "Delete quarrantined objects after restoring"
  - Click on "Safety Settings" and select "Write-protect system files after repair (Hosts file, etc)"
  - Click on "Proceed" to save these Preferences.
  - Click on the "Scan Now" button on the left.
  - Under "Select Scan Mode, be sure to select "Use Custom Scanning Options".
7. Close all programs except ad-aware.
8. Click on "Next" in the bottom right corner to start the scan.
9. Run the Ad-Aware scan and allow it to remove everything it finds and then REBOOT - Even if not prompted to.
10. After you log back in, Ad-Aware may run to finalize the scan and remove any locked files that it may of found. Allow it to finish.
Clean out temporary and temporary Internet files. Go to "Start" => "Run" and type in the box: "cleanmgr". Let it scan your system for files to remove. Make sure these 3 are checked and then press "ok" to remove:
- Temporary Files
- Temporary Internet Files
- Recycle Bin
Reboot to normal mode.
NOTE: Two, possibly three files may have been deleted from your computer by the hijacker and may need to be replaced:
- Control.exe. If control. exe is missing go to merijn and download the version of control.exe for your operating system. If you are running Windows 2000, copy it to c:\winnt\system32\. For Windows XP, copy it to c:\windows\system32\.
- hosts (with no extension). Download the Hoster. Press "Restore Original Hosts" and press "OK". Exit Program. Note: if you were using a custom Hosts file you will need to replace any of those entries yourself
- SDHelper.dll (if you are using Spybot Search & Destroy). If you have Spybot S&D installed and SDHelper.dll is missing, replace it with this one. Copy the file to the folder containing your Spybot S&D program (normally C:\Program Files\Spybot - Search & Destroy)
Additionally, Please check your ActiveX security settings. They may have been changed by this CWS variant to allow ALL ActiveX!! If they have been changed, reset your active x security settings in IE as recommended.In IE, click on "Tools" => "Internet Options" and under the "Security" tab, click on "Custom Level" and make sure that the following settings are correct:
- Download signed ActiveX controls (Prompt)
- Download unsigned ActiveX controls (Disable)
- Initialize and script ActiveX controls not marked as safe (Disable)
- Run ActiveX controls and plug-ins (Enabled) (This actually refers to Java and Flash, not ActiveX)
- Script ActiveX controls marked safe for scripting (Prompt)
Do an online scan at TrendMicro's site. Let it remove any infected files found.
Finally, when you are all done, please post the new HJT log and the AboutBuster log here for review.

Quote box for Step #11

Quote:

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\HSA]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\SE]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\SW]

JSantos · #8 (**permalink**) 11-10-2004, 06:51 PM

It seems to work... i reboot and the program still open fine - it didn´t happen until now.

send you the HJT log and tha Aboutbuster log in below:

Logfile of HijackThis v1.98.2
Scan saved at 19:35:19, on 11-10-2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programas\Apoint2K\Apoint.exe
C:\PROGRA~1\LAUNCH~1\QtaET2S.EXE
C:\Programas\Java\j2re1.4.2_03\bin\jusched.exe
C:\Programas\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programas\Ficheiros comuns\Symantec Shared\ccApp.exe
C:\Programas\Spyware Doctor\spydoctor.exe
C:\Programas\WinZip\WZQKPICK.EXE
C:\Programas\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Programas\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Programas\Apoint2K\Apntex.exe
C:\Programas\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Programas\Ficheiros comuns\Symantec Shared\ccEvtMgr.exe
C:\Programas\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Programas\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\Programas\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Programas\Messenger\msmsgs.exe
C:\Documents and Settings\Cliente\Os meus documentos\Os meus ficheiros recebidos\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\lznby.dll/sp.html#22776
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\hrxyl.dll/sp.html#22776
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://hrxyl.dll/index.html#22776
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\lznby.dll/sp.html#22776
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer disponibilizado por - Clix
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hiperligações
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {99368009-0A9B-D27D-477D-7DCB633E7E12} - C:\WINDOWS\msgt.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programas\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programas\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [Apoint] C:\Programas\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtaET2S.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programas\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programas\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ccApp] C:\Programas\Ficheiros comuns\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Programas\Ficheiros comuns\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [Ad-aware] "C:\Programas\Lavasoft\Ad-aware 6\Ad-aware.exe" +c
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Programas\Spyware Doctor\spydoctor.exe" /Q
O4 - Global Startup: Microsoft Office.lnk = C:\Programas\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programas\WinZip\WZQKPICK.EXE
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Programas\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.clix.pt
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab

_________________________

Scanned at: 1:07:27 on: 11-10-2004

-- Scan 1 ---------------------------
About:Buster Version 3.0
Reference List : 15

ADS not scanned System(FAT)
Removed 2 Random Key Entries
Deleted 1 Service Keys Successfully!
Removed! : C:\WINDOWS\wkdsum.dat
Removed! : C:\WINDOWS\xbtvxd.dat
Removed! : C:\WINDOWS\xadljd.dat
Removed! : C:\WINDOWS\ypfrqz.dat
Removed! : C:\WINDOWS\oogxuj.dat
Removed! : C:\WINDOWS\wetrqs.dat
Removed! : C:\WINDOWS\ijzyfx.dat
Removed! : C:\WINDOWS\raxnl.dat
Removed! : C:\WINDOWS\atlyo32.exe
Removed! : C:\WINDOWS\bpyfkq.dat
Removed! : C:\WINDOWS\nbvbxx.dat
Removed! : C:\WINDOWS\qqpurj.dat
Removed! : C:\WINDOWS\n_kurywt.dat
Removed! : C:\WINDOWS\fvzhn.dat
Removed! : C:\WINDOWS\vhowui.dat
Removed! : C:\WINDOWS\dakcnb.dat
Removed! : C:\WINDOWS\atllf32.exe
Removed! : C:\WINDOWS\tnvtgi.dat
Removed! : C:\WINDOWS\sgxwrv.dat
Removed! : C:\WINDOWS\nuardg.dat
Removed! : C:\WINDOWS\prsrbh.dat
Removed! : C:\WINDOWS\oeoxke.dat
Removed! : C:\WINDOWS\pebwtm.dat
Removed! : C:\WINDOWS\bychpt.dat
Removed! : C:\WINDOWS\grtdfh.dat
Removed! : C:\WINDOWS\pdmmrs.dat
Removed! : C:\WINDOWS\hnxdxh.dat
Removed! : C:\WINDOWS\esyfro.dat
Removed! : C:\WINDOWS\zpttco.dat
Removed! : C:\WINDOWS\dfxtpc.dat
Removed! : C:\WINDOWS\vvyaay.dat
Removed! : C:\WINDOWS\cenwqu.dat
Removed! : C:\WINDOWS\qewnsu.dat
Removed! : C:\WINDOWS\sphjfa.dat
Removed! : C:\WINDOWS\gunrot.dat
Removed! : C:\WINDOWS\gfejye.dat
Removed! : C:\WINDOWS\rszzws.dat
Removed! : C:\WINDOWS\ssburo.dat
Removed! : C:\WINDOWS\titbjf.dat
Removed! : C:\WINDOWS\dubfvs.dat
Removed! : C:\WINDOWS\vbwxum.dat
Removed! : C:\WINDOWS\ovrwxc.dat
Removed! : C:\WINDOWS\ynxjtv.dat
Removed! : C:\WINDOWS\qynazi.dat
Removed! : C:\WINDOWS\lwmqeu.dat
Removed! : C:\WINDOWS\hibzdc.dat
Removed! : C:\WINDOWS\iyizko.dat
Removed! : C:\WINDOWS\yzocll.dat
Removed! : C:\WINDOWS\axjfxy.dat
Removed! : C:\WINDOWS\wkrybt.dat
Removed! : C:\WINDOWS\nsfqes.dat
Removed! : C:\WINDOWS\n_zgawjl.dat
Removed! : C:\WINDOWS\dpxoyg.dat
Removed! : C:\WINDOWS\ubtofp.dat
Removed! : C:\WINDOWS\syshs.exe
Removed! : C:\WINDOWS\fxmjnw.dat
Removed! : C:\WINDOWS\qwsjjw.dat
Removed! : C:\WINDOWS\tnlkdt.dat
Removed! : C:\WINDOWS\uotzej.dat
Removed! : C:\WINDOWS\msvc.exe
Removed! : C:\WINDOWS\argruo.dat
Removed! : C:\WINDOWS\mhepos.dat
Removed! : C:\WINDOWS\n_vwhgue.dat
Removed! : C:\WINDOWS\n_sgaqyb.dat
Removed! : C:\WINDOWS\gkxmbz.dat
Removed! : C:\WINDOWS\lvrwqz.dat
Removed! : C:\WINDOWS\ryuqbg.dat
Removed! : C:\WINDOWS\xxlcba.dat
Removed! : C:\WINDOWS\dbvdcz.dat
Removed! : C:\WINDOWS\krhglq.dat
Removed! : C:\WINDOWS\zieywh.dat
Removed! : C:\WINDOWS\glwrak.dat
Removed! : C:\WINDOWS\pvxnqz.dat
Removed! : C:\WINDOWS\sysye.exe
Removed! : C:\WINDOWS\wpnftk.dat
Removed! : C:\WINDOWS\ebpkdv.dat
Removed! : C:\WINDOWS\dydizf.dat
Removed! : C:\WINDOWS\yyanck.dat
Removed! : C:\WINDOWS\btrkzy.dat
Removed! : C:\WINDOWS\netxx.exe
Error Removing! : C:\WINDOWS\rkaoim.dat
Removed! : C:\WINDOWS\sqynzu.dat
Removed! : C:\WINDOWS\ntnz32.exe
Removed! : C:\WINDOWS\ccryue.dat
Removed! : C:\WINDOWS\rchzxs.dat
Removed! : C:\WINDOWS\mstc32.exe
Removed! : C:\WINDOWS\nropto.dat
Removed! : C:\WINDOWS\sbnnwm.dat
Removed! : C:\WINDOWS\n_awentu.dat
Removed! : C:\WINDOWS\n_wwacno.dat
Removed! : C:\WINDOWS\omhtpt.dat
Removed! : C:\WINDOWS\xuiobk.dat
Removed! : C:\WINDOWS\sdkip.exe
Removed! : C:\WINDOWS\crtn32.exe
Removed! : C:\WINDOWS\inskli.dat
Removed! : C:\WINDOWS\lxonb.dat
Removed! : C:\WINDOWS\ehxlkv.dat
Removed! : C:\WINDOWS\xwmkif.dat
Removed! : C:\WINDOWS\n_wsewtx.dat
Removed! : C:\WINDOWS\n_tufnpu.dat
Removed! : C:\WINDOWS\nnxlzr.dat
Removed! : C:\WINDOWS\kbakzm.dat
Removed! : C:\WINDOWS\msje32.dll
Removed! : C:\WINDOWS\xszgsi.dat
Removed! : C:\WINDOWS\addry32.dll
Removed! : C:\WINDOWS\eauiud.dat
Removed! : C:\WINDOWS\jluwqj.dat
Removed! : C:\WINDOWS\rnqux.dat
Removed! : C:\WINDOWS\atljk32.dll
Removed! : C:\WINDOWS\htxir.dat
Removed! : C:\WINDOWS\rjzwem.dat
Removed! : C:\WINDOWS\hktdaj.dat
Removed! : C:\WINDOWS\ybyzaw.dat
Removed! : C:\WINDOWS\windh32.dll
Removed! : C:\WINDOWS\sfdoz.dat
Removed! : C:\WINDOWS\bnslnz.dat
Removed! : C:\WINDOWS\ester.dll
Removed! : C:\WINDOWS\ouvjc.dat
Removed! : C:\WINDOWS\qbrjd.dat
Removed! : C:\WINDOWS\mbrkko.dat
Removed! : C:\WINDOWS\crbn.exe
Removed! : C:\WINDOWS\ntzt32.dll
Removed! : C:\WINDOWS\sdkha.exe
Removed! : C:\WINDOWS\netnn.exe
Removed! : C:\WINDOWS\fmevb.dat
Removed! : C:\WINDOWS\ipru.dll
Removed! : C:\WINDOWS\d3vi.dll
Removed! : C:\WINDOWS\javawo.dll
Removed! : C:\WINDOWS\trcal.dat
Removed! : C:\WINDOWS\ivfsq.dll
Removed! : C:\WINDOWS\sdkrt32.dll
Removed! : C:\WINDOWS\mxsld.dat
Removed! : C:\WINDOWS\ipwn.exe
Removed! : C:\WINDOWS\mfcxt32.dll
Removed! : C:\WINDOWS\vmazi.dat
Removed! : C:\WINDOWS\cred32.dll
Removed! : C:\WINDOWS\mxsld.dll
Removed! : C:\WINDOWS\sdkbm32.dll
Removed! : C:\WINDOWS\tqjhc.dll
Removed! : C:\WINDOWS\wmhvj.dat
Removed! : C:\WINDOWS\ypssw.dll
Removed! : C:\WINDOWS\apile.exe
Removed! : C:\WINDOWS\lmumx.dat
Removed! : C:\WINDOWS\jobxe.dat
Removed! : C:\WINDOWS\khoro.dat
Removed! : C:\WINDOWS\wswxi.dat
Removed! : C:\WINDOWS\pdjzt.dat
Removed! : C:\WINDOWS\pdjzt.dll
Removed! : C:\WINDOWS\mvnlmu.dat
Removed! : C:\WINDOWS\poqwjp.dat
Removed! : C:\WINDOWS\yaglg.dat
Removed! : C:\WINDOWS\gljyd.dat
Removed! : C:\WINDOWS\zodgp.dat
Removed! : C:\WINDOWS\bwekd.dll
Removed! : C:\WINDOWS\ipaq32.exe
Removed! : C:\WINDOWS\csrmm.dat
Removed! : C:\WINDOWS\sdkpz.dll
Removed! : C:\WINDOWS\jpvhw.dat
Removed! : C:\WINDOWS\jpvhw.dll
Removed! : C:\WINDOWS\ckzfk.dat
Removed! : C:\WINDOWS\xriau.dat
Removed! : C:\WINDOWS\fkfqe.dat
Removed! : C:\WINDOWS\cvkag.dat
Removed! : C:\WINDOWS\appyf32.dll
Removed! : C:\WINDOWS\ipxp.exe
Removed! : C:\WINDOWS\javaxf.dll
Removed! : C:\WINDOWS\msxl32.dll
Removed! : C:\WINDOWS\njwlt.dat
Removed! : C:\WINDOWS\pngho.dat
Removed! : C:\WINDOWS\pngho.dll
Removed! : C:\WINDOWS\zzqja.dat
Removed! : C:\WINDOWS\iecc.dll
Removed! : C:\WINDOWS\zzqja.dll
Removed! : C:\WINDOWS\javayv.exe
Removed! : C:\WINDOWS\netwx32.exe
Removed! : C:\WINDOWS\auslv.dat
Removed! : C:\WINDOWS\cpqcs.dat
Removed! : C:\WINDOWS\zzklp.dll
Removed! : C:\WINDOWS\appba.dll
Removed! : C:\WINDOWS\mxubz.dat
Removed! : C:\WINDOWS\winut.dll
Removed! : C:\WINDOWS\hliyb.dat
Removed! : C:\WINDOWS\ipjb32.dll
Removed! : C:\WINDOWS\winae.exe
Removed! : C:\WINDOWS\saxzx.dat
Removed! : C:\WINDOWS\nrszio.dat
Removed! : C:\WINDOWS\slqut.dat
Removed! : C:\WINDOWS\uwjrg.dat
Removed! : C:\WINDOWS\relrg.dat
Removed! : C:\WINDOWS\qakfx.dat
Removed! : C:\WINDOWS\lhdob.dat
Removed! : C:\WINDOWS\ftuve.dat
Removed! : C:\WINDOWS\msag32.dll
Removed! : C:\WINDOWS\atlgv.dll
Removed! : C:\WINDOWS\mfcov32.dll
Removed! : C:\WINDOWS\ieud.dll
Removed! : C:\WINDOWS\netdr32.dll
Removed! : C:\WINDOWS\netfr32.dll
Removed! : C:\WINDOWS\tedsp.dat
Removed! : C:\WINDOWS\vhnok.dat
Removed! : C:\WINDOWS\addeb32.exe
Removed! : C:\WINDOWS\giljr.dat
Removed! : C:\WINDOWS\ntzq.exe
Removed! : C:\WINDOWS\efhsv.dat
Removed! : C:\WINDOWS\qzyeb.dat
Removed! : C:\WINDOWS\iregl.dat
Removed! : C:\WINDOWS\netav32.exe
Removed! : C:\WINDOWS\ugkqv.dat
Removed! : C:\WINDOWS\appbx32.dll
Removed! : C:\WINDOWS\khqfe.dat
Removed! : C:\WINDOWS\ijbit.dat
Removed! : C:\WINDOWS\iqvlg.dat
Removed! : C:\WINDOWS\citki.dat
Removed! : C:\WINDOWS\zmeod.dat
Removed! : C:\WINDOWS\dlvjv.dat
Removed! : C:\WINDOWS\mtgjv.dat
Removed! : C:\WINDOWS\nnlff.dat
Removed! : C:\WINDOWS\gofby.dat
Removed! : C:\WINDOWS\xgzpp.dat
Removed! : C:\WINDOWS\zrrlc.dat
Removed! : C:\WINDOWS\gvjpj.dat
Removed! : C:\WINDOWS\burbb.dat
Removed! : C:\WINDOWS\dfkyo.dat
Removed! : C:\WINDOWS\oovbk.dat
Removed! : C:\WINDOWS\kgrqe.dat
Removed! : C:\WINDOWS\addgu.dll
Removed! : C:\WINDOWS\nuhln.dat
Removed! : C:\WINDOWS\ommgq.dat
Removed! : C:\WINDOWS\msgt.dll
Removed! : C:\WINDOWS\hrxyl.dat
Removed! : C:\WINDOWS\crbg32.exe
Removed! : C:\WINDOWS\d3of.exe
Removed! : C:\WINDOWS\system32\ggvke.dat
Removed! : C:\WINDOWS\system32\hrngz.dat
Removed! : C:\WINDOWS\system32\bnlxw.dat
Removed! : C:\WINDOWS\system32\ujdxl.dat
Removed! : C:\WINDOWS\system32\iuhke.dat
Removed! : C:\WINDOWS\system32\bnmeo.dat
Removed! : C:\WINDOWS\system32\eeadx.dat
Removed! : C:\WINDOWS\system32\fkoiz.dat
Removed! : C:\WINDOWS\system32\lqnmi.dat
Removed! : C:\WINDOWS\system32\nmldg.dat
Removed! : C:\WINDOWS\system32\lkait.dat
Removed! : C:\WINDOWS\system32\mvfcd.dat
Removed! : C:\WINDOWS\system32\xxpta.dat
Removed! : C:\WINDOWS\system32\jvewc.dat
Removed! : C:\WINDOWS\system32\pfzia.dat
Removed! : C:\WINDOWS\system32\apiln.exe
Removed! : C:\WINDOWS\system32\wftsg.dat
Removed! : C:\WINDOWS\system32\aentu.dll
Removed! : C:\WINDOWS\system32\yhbrw.dat
Removed! : C:\WINDOWS\system32\llejt.dat
Removed! : C:\WINDOWS\system32\thucl.dat
Removed! : C:\WINDOWS\system32\ebtzo.dat
Removed! : C:\WINDOWS\system32\lrttr.dll
Removed! : C:\WINDOWS\system32\zsmor.dat
Removed! : C:\WINDOWS\system32\yvxmn.dat
Removed! : C:\WINDOWS\system32\uaaev.dll
Removed! : C:\WINDOWS\system32\gocaq.dat
Removed! : C:\WINDOWS\system32\ikayn.dat
Removed! : C:\WINDOWS\system32\fuzty.dat
Removed! : C:\WINDOWS\system32\favet.dat
Removed! : C:\WINDOWS\system32\gxjpl.dll
Removed! : C:\WINDOWS\system32\jlqmr.dat
Removed! : C:\WINDOWS\system32\qtdsp.dat
Removed! : C:\WINDOWS\system32\qtdsp.dll
Removed! : C:\WINDOWS\system32\hbfnt.dat
Removed! : C:\WINDOWS\system32\lenrs.dat
Removed! : C:\WINDOWS\system32\exhyy.dat
Removed! : C:\WINDOWS\system32\xhyye.dll
Removed! : C:\WINDOWS\system32\waqdg.dat
Removed! : C:\WINDOWS\system32\kiwad.dat
Removed! : C:\WINDOWS\system32\qhjec.dll
Removed! : C:\WINDOWS\system32\hdoag.dat
Removed! : C:\WINDOWS\system32\hdoag.dll
Removed! : C:\WINDOWS\system32\afrjr.dat
Removed! : C:\WINDOWS\system32\iwpfm.dat
Removed! : C:\WINDOWS\system32\ltbco.dat
Removed! : C:\WINDOWS\system32\xwnyu.dat
Removed! : C:\WINDOWS\system32\knitq.dat
Removed! : C:\WINDOWS\system32\etopk.dat
Removed! : C:\WINDOWS\system32\bamsc.dat
Removed! : C:\WINDOWS\system32\cdwow.dat
Removed! : C:\WINDOWS\system32\cdwow.dll
Removed! : C:\WINDOWS\system32\vnkcw.dat
Removed! : C:\WINDOWS\system32\etopk.dll
Removed! : C:\WINDOWS\system32\lqbpl.dat
Removed! : C:\WINDOWS\system32\zuaxg.dll
Removed! : C:\WINDOWS\system32\bmygx.dat
Removed! : C:\WINDOWS\system32\dzmts.dat
Removed! : C:\WINDOWS\system32\erroc.dat
Removed! : C:\WINDOWS\system32\gukkp.dll
Removed! : C:\WINDOWS\system32\zhhhg.dat
Removed! : C:\WINDOWS\system32\doquq.dat
Removed! : C:\WINDOWS\system32\vydwb.dll
Removed! : C:\WINDOWS\system32\svsst.dat
Removed! : C:\WINDOWS\system32\npzvb.dat
Removed! : C:\WINDOWS\system32\swymr.dat
Removed! : C:\WINDOWS\system32\hsdwr.dat
Removed! : C:\WINDOWS\system32\naexl.dat
Removed! : C:\WINDOWS\system32\tddpd.dat
Removed! : C:\WINDOWS\system32\gmzxo.dat
Removed! : C:\WINDOWS\system32\ratdv.dat
Removed! : C:\WINDOWS\system32\uwiua.dat
Removed! : C:\WINDOWS\system32\tddzi.dat
Removed! : C:\WINDOWS\system32\uwrbs.dat
Removed! : C:\WINDOWS\system32\myykf.dat
Removed! : C:\WINDOWS\system32\nbqgs.dat
Removed! : C:\WINDOWS\system32\fxyhh.dat
Removed! : C:\WINDOWS\system32\lcwwi.dat
Removed! : C:\WINDOWS\system32\fxmmg.dat
Removed! : C:\WINDOWS\system32\fcray.dat
Removed! : C:\WINDOWS\system32\potky.dat
Removed! : C:\WINDOWS\system32\qpobt.dat
Removed! : C:\WINDOWS\system32\vrpsy.dat
Removed! : C:\WINDOWS\system32\qwxjr.dat
Removed! : C:\WINDOWS\system32\lrvzo.dat
Removed! : C:\WINDOWS\system32\hxpqw.dat
Removed! : C:\WINDOWS\system32\ypfrq.dat
Attempted Clean Of Temp folder.
Removed Uninstall Key (HSA)
Removed Uninstall Key (SE)
Removed Uninstall Key (SW)
Pages Reset... Done!

-- Scan 2 ---------------------------
About:Buster Version 3.0
Reference List : 15

ADS not scanned System(FAT)
Removed 2 Random Key Entries
Removed! : C:\WINDOWS\rkaoim.dat
Attempted Clean Of Temp folder.
Pages Reset... Done!

Do you think it´s done?

Thanks agains for everything you´re done...

owen · #9 (**permalink**) 12-10-2004, 05:45 PM

1. Boot into Safe Mode
2. Run About:Buster once in Safe Mode
3. Restart Hijack This and put a checkmark next to all R1 and R0 entries and also these entries:

R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {99368009-0A9B-D27D-477D-7DCB633E7E12} - C:\WINDOWS\msgt.dll (file missing)

Click Fix Checked

4. Run About:Buster again
5. Reboot into Normal Mode
6. Run Ad-aware and remove all bad files found
7. Post a fresh log

JSantos · #10 (**permalink**) 14-10-2004, 01:37 AM

I did what you told me to... Here it is the final HJT log.

Logfile of HijackThis v1.98.2
Scan saved at 1:44:56, on 14-10-2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programas\Apoint2K\Apoint.exe
C:\PROGRA~1\LAUNCH~1\QtaET2S.EXE
C:\Programas\Java\j2re1.4.2_03\bin\jusched.exe
C:\Programas\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programas\Ficheiros comuns\Symantec Shared\ccApp.exe
C:\Programas\Spyware Doctor\spydoctor.exe
C:\Programas\Apoint2K\Apntex.exe
C:\Programas\WinZip\WZQKPICK.EXE
C:\Programas\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Programas\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Programas\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Programas\Ficheiros comuns\Symantec Shared\ccEvtMgr.exe
C:\Programas\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Programas\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\Programas\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programas\Internet Explorer\iexplore.exe
C:\Programas\Messenger\msmsgs.exe
C:\Documents and Settings\Cliente\Os meus documentos\Os meus ficheiros recebidos\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\lznby.dll/sp.html#22776
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\hrxyl.dll/sp.html#22776
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ctoc.pt/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\lznby.dll/sp.html#22776
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer disponibilizado por - Clix
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hiperligações
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programas\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programas\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [Apoint] C:\Programas\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtaET2S.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programas\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programas\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ccApp] C:\Programas\Ficheiros comuns\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Programas\Ficheiros comuns\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [Ad-aware] "C:\PROGRA~1\LAVASOFT\AD-AWA~1\Ad-aware.exe" +c
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Programas\Spyware Doctor\spydoctor.exe" /Q
O4 - Global Startup: Microsoft Office.lnk = C:\Programas\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programas\WinZip\WZQKPICK.EXE
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Programas\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.clix.pt
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab

I tnhink the problem is solved. Don´t you?

Regards...