Publicado em 27 de jan.

[Arquivado] Lentidão e trava do nada

#topicos-arquivados-seguranca-malwares

Olá pessoal :D

O meu computador ele fica lento do nada e trava do nada tbm :x

queria que voces desse uma olhada em meu log. :D

ae está.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:53:44, on 27/1/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Common Files\VMware\USB\vmware-usbarbitrator.exe

C:\WINDOWS\system32\vmnat.exe

C:\WINDOWS\system32\vmnetdhcp.exe

C:\Arquivos de programas\VMware\VMware Workstation\vmware-authd.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Windows Live\Contacts\wlcomm.exe

C:\xampp\xampp-control.exe

C:\xampp\apache\bin\httpd.exe

C:\xampp\mysql\bin\mysqld.exe

C:\xampp\apache\bin\httpd.exe

C:\WINDOWS\system32\msiexec.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Administrador\Meus documentos\Downloads\HiJackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.localstrike.com.ar/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.localstrike.com.ar/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.localstrike.com.ar/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.localstrike.com.ar/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.localstrike.com.ar/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.localstrike.com.ar/

R3 - URLSearchHook: MAX BR Toolbar - {fe379c63-1156-4c8c-8dbb-f823d3ea4b37} - C:\Arquivos de programas\MAX_BR\tbMAX_.dll

R3 - URLSearchHook: Online Radio Brazil Toolbar - {f4c23ca5-ed6c-4376-80ad-62f9161a7286} - C:\Arquivos de programas\Online_Radio_Brazil\tbOnli.dll

R3 - URLSearchHook: Messenger Plus Live Toolbar - {9b339f6e-ddcd-401b-8764-230adbd01761} - C:\Arquivos de programas\Messenger_Plus_Live\tbMess.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\ARQUIV~1\MICROS~4\Office12\GRA8E1~1.DLL

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Messenger Plus Live Toolbar - {9b339f6e-ddcd-401b-8764-230adbd01761} - C:\Arquivos de programas\Messenger_Plus_Live\tbMess.dll

O2 - BHO: VCS3IESupport Class - {B9D6B3C2-09AD-464A-8162-8C55114C808A} - C:\Arquivos de programas\AV VCS 3.0 Gold\Vcs3RT.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: Online Radio Brazil Toolbar - {f4c23ca5-ed6c-4376-80ad-62f9161a7286} - C:\Arquivos de programas\Online_Radio_Brazil\tbOnli.dll

O2 - BHO: MAX BR Toolbar - {fe379c63-1156-4c8c-8dbb-f823d3ea4b37} - C:\Arquivos de programas\MAX_BR\tbMAX_.dll

O3 - Toolbar: MAX BR Toolbar - {fe379c63-1156-4c8c-8dbb-f823d3ea4b37} - C:\Arquivos de programas\MAX_BR\tbMAX_.dll

O3 - Toolbar: Online Radio Brazil Toolbar - {f4c23ca5-ed6c-4376-80ad-62f9161a7286} - C:\Arquivos de programas\Online_Radio_Brazil\tbOnli.dll

O3 - Toolbar: Messenger Plus Live Toolbar - {9b339f6e-ddcd-401b-8764-230adbd01761} - C:\Arquivos de programas\Messenger_Plus_Live\tbMess.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~4\Office12\EXCEL.EXE/3000

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~4\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~4\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~4\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\arquivos de programas\vmware\vmware workstation\vsocklib.dll

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{D2DCB7B9-803F-4036-BCE0-B8A66606E4B7}: NameServer = 208.67.222.222,208.67.220.220

O17 - HKLM\System\CCS\Services\Tcpip\..\{DC811895-81B2-4D4B-A085-C0CBEC145284}: NameServer = 192.168.0.1

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\ARQUIV~1\MICROS~4\Office12\GR99D3~1.DLL

O23 - Service: 1264023843 (.1264023843) - Unknown owner - C:\Arquivos de programas\1264023843\USER1264023843L.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\Support Controls\ssrc.exe

O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Arquivos de programas\VMware\VMware Workstation\vmware-ufad.exe

O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Arquivos de programas\VMware\VMware Workstation\vmware-authd.exe

O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe

O23 - Service: VMware USB Arbitration Service (VMUSBArbService) - VMware, Inc. - C:\Arquivos de programas\Common Files\VMware\USB\vmware-usbarbitrator.exe

O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe

End of file - 7691 bytes

Discussão (16)

Entre ou cadastre-se para participar da discussão

Entrar Criar conta

Power Max· 28 de jan.

:) Olá leoinuzuka!

:seta: Siga, por gentileza, as dicas destes tutoriais:

'>http://dicasetutoriaisparapc.blogspot.com/2009/10/tutorial-do-malwarebytes-anti-malware.html"]Tutorial do Malwarebytes Anti-Malware

'>http://dicasetutoriaisparapc.blogspot.com/2009/10/tutorial-do-ad-remover.html"]Tutorial do Ad-Remover

'>http://dicasetutoriaisparapc.blogspot.com/2009/11/tutorial-do-toolbar-sd.html"]Tutorial do Toolbar S&D

_________________________________

:seta: Sugiro que você salve ou imprima essas instruções abaixo, pois em alguns momentos você poderá precisar usar o computador sem o acesso à internet:

Faça o download do ComboFix

Salve-o no Desktop (área de trabalho).

* Desabilite as proteções residente de: antivírus, antispywares e firewall ( menos o do Windows! )

* Feche todas as janelas e execute a ferramenta.

* Ps: A execução, por comando, também é possível:

* Vá em Iniciar --> Executar --> Digite ou cole:

"%userprofile%\desktop\Combofix.exe" /killall

/applications/core/interface/imageproxy/imageproxy.php?img=http://img181.imageshack.us/img181/5825/combofixejr8.gif&key=0d882a59a7a65b06e1b50e837804afc9002b25433ef74e0c3f66f43a58058f7b" alt="combofixejr8.gif" />

* Clique em Ok.

* Na solicitação: "Negação de garantia de software" --> Clique em Sim.

/applications/core/interface/imageproxy/imageproxy.php?img=http://img.photobucket.com/albums/v706/ried7/RcAuto1.gif&key=0010234c6eff8b98a829fe5910d3fd47cc8c551f0c1836fc4748c11079a71d03" alt="RcAuto1.gif" />

* Não possuindo o "'>http://support.microsoft.com/kb/307654/pt-br"]Console de Recuperação",aceite optar pela instalação do mesmo.

* Terminando,clique Sim ou Yes. --> Aguarde.

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

:!: Caso aconteça a notificação de: Aplicativo Win32 inválido ou alguma mensagem parecida com esta, delete a ferramenta ComboFix.exe e faça, novamente, seu download.

* Salve-a no Desktop,renomeada como: Kombo.exe

* Ps: Nomeie durante o salvamento,e não após salvá-la!

* Ps: Surgindo alguma mensagem de erro, rode o ComboFix.exe em "'>http://dicasetutoriaisparapc.blogspot.com/2009/11/ferramentas-para-reparar-o-modo-seguro.html"]Modo Seguro". <-- Link!

* Ps: Na presença de atividades rootkit,teremos a seguinte janela de notificação:

/applications/core/interface/imageproxy/imageproxy.php?img=http://img.photobucket.com/albums/v666/sUBs/Rookit_found.gif&key=eb1b849776e4208479b15adbf0e86845810495533720ff18c63647e4d0943f29" alt="Rookit_found.gif" />

* Ps: Anote essas detecções, e dê o OK. Neste caso poste estas detecções que você terá anotado em sua próxima resposta juntamente com os logs pedidos.

* Ps: Para completar as remoções, talvez haja necessidade da ferramenta reiniciar o computador. <-- Aguarde!

* Ps: Para evitar problemas, siga todas as recomendações propostas.

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

* Abrir-se-á a janela Auto Scan. --> Aguarde!

* Para finalizar remoções, o ComboFix poderá reiniciar o computador.

* Se houver necessidade, digite a opção ( 1 ) --> Aperte Enter! --> Aguarde a conclusão!

* Durante o scan, evite manusear o mouse ou teclado! <-- Importante!

* Caso, por algum motivo de força maior, precise parar ou sair do ComboFix,tecle "N" ou "2" --> Aperte Enter.

<><><><><><><><><><><><>

Poste o log do Combofix que estará em C:\ComboFix.txt juntamente com o log que estará em C:\Ad-Report-CLEAN[1].log, o log que estará em C:\ToolBar SD\TB_1.txt e um novo log do Hijackthis em sua próxima resposta e nos diga como está o seu PC depois disto.

Ficamos no aguardo.

leoinuzuka· 28 de jan.

ComboFix 10-01-28.04 - Administrador 28/01/2010 20:54:36.2.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.2430.1915 [GMT -2:00]

Executando de: c:\documents and settings\Administrador\Desktop\ComboFix.exe

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

c:\documents and settings\Administrador\Dados de aplicativos\addon.dat

c:\windows\system32\ActNAV_cltDynam.dat

((((((((((((((((((((((((((((((((((((((( Drivers/Serviços )))))))))))))))))))))))))))))))))))))))))))))))))

-------\Legacy_AIC32P

-------\Service_aic32p

(((((((((((((((( Arquivos/Ficheiros criados de 2009-12-28 to 2010-01-28 ))))))))))))))))))))))))))))

2010-01-28 22:49 . 2010-01-28 22:51 -------- d-----w- C:\ToolBar SD

2010-01-28 22:20 . 2010-01-28 22:45 -------- d-----w- C:\Ad-Remover

2010-01-28 12:24 . 2010-01-28 12:24 -------- d-----w- c:\arquivos de programas\SpacialAudio

2010-01-28 12:24 . 2007-10-16 12:07 442368 ----a-w- c:\windows\system32\GDS32.DLL

2010-01-28 12:24 . 2005-09-23 02:05 626688 ----a-w- c:\windows\system32\msvcr80.dll

2010-01-28 12:24 . 2005-09-23 02:05 548864 ----a-w- c:\windows\system32\msvcp80.dll

2010-01-28 12:24 . 2010-01-28 12:24 -------- d-----w- c:\arquivos de programas\Firebird

2010-01-28 10:30 . 2010-01-28 10:34 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\Audacity

2010-01-28 10:29 . 2010-01-28 10:29 -------- d-----w- c:\arquivos de programas\Audacity 1.3 Beta (Unicode)

2010-01-28 10:02 . 2010-01-28 10:02 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\Publish Providers

2010-01-28 10:00 . 2010-01-28 10:00 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Sony

2010-01-28 09:59 . 2010-01-28 09:59 -------- d-----w- c:\arquivos de programas\Sony

2010-01-28 09:57 . 2010-01-28 10:02 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\Sony

2010-01-28 09:44 . 2010-01-28 09:44 -------- d-----w- c:\arquivos de programas\MP3Gain

2010-01-28 09:33 . 2010-01-28 09:33 -------- d-----w- c:\arquivos de programas\Essentials Codec Pack

2010-01-28 09:25 . 2010-01-28 09:25 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\Media Player Classic

2010-01-28 09:25 . 2009-12-12 14:15 178176 ----a-w- c:\windows\system32\unrar.dll

2010-01-28 04:48 . 2010-01-28 04:48 -------- d-----w- c:\arquivos de programas\Ares

2010-01-28 04:15 . 2010-01-28 21:25 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\FileZilla

2010-01-28 04:15 . 2010-01-28 04:15 -------- d-----w- c:\arquivos de programas\FileZilla FTP Client

2010-01-28 03:58 . 2010-01-28 19:25 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\skypePM

2010-01-28 03:58 . 2010-01-28 03:58 56 ---ha-w- c:\windows\system32\ezsidmv.dat

2010-01-28 03:56 . 2010-01-28 22:48 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\Skype

2010-01-28 03:56 . 2010-01-28 03:56 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Skype

2010-01-28 03:56 . 2010-01-28 03:56 -------- d-----r- c:\arquivos de programas\Skype

2010-01-28 03:55 . 2010-01-28 03:56 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Skype

2010-01-27 14:15 . 2010-01-27 14:15 52224 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll

2010-01-27 14:15 . 2010-01-27 14:15 117760 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL

2010-01-27 14:15 . 2010-01-27 14:15 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\SUPERAntiSpyware.com

2010-01-27 14:15 . 2010-01-27 14:15 -------- d-----w- c:\arquivos de programas\SUPERAntiSpyware

2010-01-27 14:15 . 2010-01-27 14:15 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\SUPERAntiSpyware.com

2010-01-27 14:14 . 2010-01-27 14:14 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Wise Installation Wizard

2010-01-27 13:14 . 2010-01-27 13:14 -------- d-----w- c:\arquivos de programas\CCleaner

2010-01-27 10:23 . 2010-01-27 10:23 -------- d-----w- c:\arquivos de programas\No-IP

2010-01-26 23:52 . 2010-01-27 00:08 -------- d-----w- c:\arquivos de programas\AV VCS 3.0 Gold

2010-01-26 23:52 . 2010-01-26 23:53 16 ----a-w- c:\windows\system32\DataRnvx.dat

2010-01-26 23:52 . 2003-04-30 15:24 6852 ----a-w- c:\windows\system32\drivers\Vcs.sys

2010-01-26 23:39 . 2010-01-26 23:39 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\Avnex

2010-01-26 23:38 . 2008-12-26 14:56 17792 ----a-w- c:\windows\system32\drivers\vcsvad.sys

2010-01-26 23:37 . 2010-01-26 23:45 -------- d-----w- c:\arquivos de programas\AV Vcs 7.0 GOLD

2010-01-26 22:08 . 2010-01-26 22:11 -------- d-----w- c:\windows\system32\Adobe

2010-01-26 20:24 . 2010-01-26 20:24 -------- d-----w- c:\arquivos de programas\MySQL

2010-01-26 20:00 . 2009-12-20 02:00 -------- d---a-w- C:\xampp

2010-01-26 09:47 . 2010-01-26 09:51 -------- d-----w- c:\windows\NV37443112.TMP

2010-01-26 08:46 . 2010-01-26 08:46 16252928 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Thinstall\Adobe Photoshop CS4\400000a400003i\FNPLicensingService.exe

2010-01-26 08:45 . 2010-01-26 08:45 16252928 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Thinstall\Adobe Photoshop CS4\1000000b00002i\rundll32.exe

2010-01-26 08:45 . 2010-01-26 08:45 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\Thinstall

2010-01-26 04:26 . 2010-01-26 04:26 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Alwil Software

2010-01-26 03:34 . 2010-01-26 05:00 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Avira

2010-01-26 03:20 . 2010-01-26 03:20 503808 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2f48f74b-n\msvcp71.dll

2010-01-26 03:20 . 2010-01-26 03:20 499712 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2f48f74b-n\jmc.dll

2010-01-26 03:20 . 2010-01-26 03:20 348160 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2f48f74b-n\msvcr71.dll

2010-01-26 03:20 . 2010-01-26 03:20 61440 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-6edc0341-n\decora-sse.dll

2010-01-26 03:20 . 2010-01-26 03:20 12800 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-6edc0341-n\decora-d3d.dll

2010-01-26 03:20 . 2010-01-26 03:20 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Java

2010-01-26 03:20 . 2010-01-26 03:20 411368 ----a-w- c:\windows\system32\deploytk.dll

2010-01-26 03:20 . 2010-01-26 03:20 -------- d-----w- c:\arquivos de programas\Java

2010-01-26 02:55 . 2010-01-26 02:55 -------- d-----w- c:\documents and settings\Administrador\DoctorWeb

2010-01-26 00:14 . 2010-01-26 04:41 -------- d-----w- c:\arquivos de programas\ESET

2010-01-26 00:14 . 2010-01-26 00:14 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\ESET

2010-01-25 21:37 . 2010-01-25 21:37 -------- d-----w- c:\windows\Lhsp

2010-01-25 21:37 . 2010-01-26 04:52 -------- d-----w- c:\arquivos de programas\VirtualDJ

2010-01-25 20:09 . 2010-01-25 20:09 0 ----a-w- c:\windows\nsreg.dat

2010-01-25 09:46 . 2010-01-27 09:50 -------- d-----w- c:\arquivos de programas\MuAwaY

2010-01-25 09:29 . 2010-01-26 01:48 -------- d-----w- c:\arquivos de programas\sXe Injected

2010-01-25 08:34 . 2010-01-25 08:34 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\Malwarebytes

2010-01-25 08:34 . 2010-01-07 18:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-01-25 08:34 . 2010-01-28 22:06 -------- d-----w- c:\arquivos de programas\Malwarebytes' Anti-Malware

2010-01-25 08:34 . 2010-01-25 08:34 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes

2010-01-25 08:34 . 2010-01-07 18:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-01-25 07:55 . 2010-01-25 07:55 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\IObit

2010-01-25 07:55 . 2010-01-25 09:22 -------- d-----w- c:\arquivos de programas\IObit

2010-01-25 07:39 . 2010-01-25 07:39 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\GetRightToGo

2010-01-24 20:44 . 2010-01-26 01:18 -------- d-----w- c:\arquivos de programas\ASPack

2010-01-24 20:33 . 2010-01-27 23:21 -------- d-----w- c:\arquivos de programas\Steam

2010-01-24 17:25 . 2010-01-25 20:54 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Messenger Plus!

2010-01-24 17:24 . 2010-01-26 01:22 -------- d-----w- c:\arquivos de programas\Messenger_Plus_Live

2010-01-24 17:24 . 2010-01-26 01:22 -------- d-----w- c:\arquivos de programas\Messenger Plus! Live

2010-01-24 05:10 . 2010-01-24 05:10 -------- d-----w- C:\6967671ef028d2d9a7ff

2010-01-24 05:10 . 2010-01-24 15:13 -------- d-----w- c:\windows\SxsCaPendDel

2010-01-23 17:11 . 2010-01-26 01:39 -------- d-----w- c:\arquivos de programas\Online_Radio_Brazil

2010-01-23 05:00 . 2010-01-23 05:00 -------- d-----w- c:\windows\ie8updates

2010-01-23 00:48 . 2008-06-14 17:34 272384 -c----w- c:\windows\system32\dllcache\bthport.sys

2010-01-23 00:48 . 2008-06-14 17:34 272384 ------w- c:\windows\system32\drivers\bthport.sys

2010-01-23 00:48 . 2009-12-21 19:07 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll

2010-01-23 00:48 . 2009-12-21 19:07 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll

2010-01-23 00:48 . 2009-12-21 19:07 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll

2010-01-23 00:48 . 2009-12-21 19:07 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll

2010-01-23 00:48 . 2009-12-21 19:08 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll

2010-01-23 00:48 . 2009-12-21 19:07 11070464 -c----w- c:\windows\system32\dllcache\ieframe.dll

2010-01-22 21:44 . 2009-08-04 17:27 2149376 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe

2010-01-22 21:44 . 2009-08-04 17:27 2070272 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe

2010-01-22 21:44 . 2009-08-04 17:27 2028032 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe

2010-01-21 19:51 . 2010-01-21 19:51 -------- d-----w- c:\arquivos de programas\Conduit

2010-01-21 19:51 . 2010-01-26 01:21 -------- d-----w- c:\arquivos de programas\MAX_BR

2010-01-21 16:13 . 2010-01-21 16:13 -------- d-----w- c:\documents and settings\Administrador\WINDOWS

2010-01-21 16:09 . 2010-01-21 16:09 -------- d-sh--w- c:\documents and settings\Administrador\IECompatCache

2010-01-21 15:25 . 2010-01-21 15:25 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\.ZMatrix

2010-01-21 15:25 . 2010-01-21 15:25 -------- d-----w- c:\arquivos de programas\Winamp

2010-01-21 15:25 . 2010-01-26 03:37 -------- d-----w- c:\arquivos de programas\ZMatrix

2010-01-21 13:49 . 2010-01-21 13:49 -------- d-----w- C:\_CLTUI_E894D6B5_E3CA_4561_A244_272400640573_Session1

2010-01-21 13:49 . 2010-01-21 13:49 -------- d-----w- C:\_CLTUI_E894D6B5_E3CA_4561_A244_272400640573_Session0

2010-01-21 09:57 . 2008-04-14 10:00 26624 ----a-w- c:\documents and settings\LocalService\Dados de aplicativos\Microsoft\UPnP Device Host\upnphost\udhisapi.dll

2010-01-21 09:26 . 2010-01-25 00:05 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\TeamViewer

2010-01-21 09:26 . 2010-01-21 09:26 -------- d-----w- c:\documents and settings\Administrador\temp

2010-01-21 08:09 . 2010-01-24 21:54 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\VMware

2010-01-21 07:41 . 2010-01-21 07:41 909312 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\VMware\VMware Workstation\Uninstaller\uninstall.exe

2010-01-21 07:41 . 2010-01-21 07:41 625200 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\VMware\VMware Workstation\Uninstaller\instUtils.dll

2010-01-21 07:41 . 2010-01-21 07:35 958000 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\VMware\VMware Workstation\Uninstaller\vnetlib64.dll

2010-01-21 07:41 . 2010-01-21 07:35 922672 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\VMware\VMware Workstation\Uninstaller\vnetlib64.exe

2010-01-21 07:41 . 2010-01-21 07:35 760368 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\VMware\VMware Workstation\Uninstaller\vnetlib.dll

2010-01-21 07:41 . 2010-01-21 07:35 731696 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\VMware\VMware Workstation\Uninstaller\vminstutil.dll

2010-01-21 07:41 . 2010-01-21 07:35 696320 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\VMware\VMware Workstation\Uninstaller\vnetlib.exe

2010-01-21 07:41 . 2010-01-21 07:35 331776 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\VMware\VMware Workstation\Uninstaller\module_ws.dll

2010-01-21 07:41 . 2010-01-21 07:35 569344 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\VMware\VMware Workstation\Uninstaller\module_core.dll

2010-01-21 07:41 . 2010-01-21 07:35 360448 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\VMware\VMware Workstation\Uninstaller\module_license.dll

2010-01-21 07:40 . 2009-10-22 02:13 59952 ----a-r- c:\windows\system32\vnetinst.dll

2010-01-21 07:40 . 2009-10-22 02:13 16560 ----a-r- c:\windows\system32\drivers\vmnetadapter.sys

2010-01-21 07:40 . 2009-10-22 06:59 334384 ----a-w- c:\windows\system32\vmnetdhcp.exe

2010-01-21 07:40 . 2009-10-22 07:00 26288 ----a-w- c:\windows\system32\drivers\vmnetuserif.sys

2010-01-21 07:40 . 2009-10-22 07:00 395824 ----a-w- c:\windows\system32\vmnat.exe

2010-01-21 07:40 . 2009-10-22 02:13 18736 ----a-r- c:\windows\system32\drivers\vmnet.sys

2010-01-21 07:40 . 2009-10-22 07:00 760368 ----a-w- c:\windows\system32\vnetlib.dll

2010-01-21 07:40 . 2009-10-22 07:00 23216 ----a-w- c:\windows\system32\drivers\VMkbd.sys

2010-01-21 07:40 . 2010-01-28 23:00 -------- d-----w- c:\documents and settings\LocalService\Dados de aplicativos\VMware

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

2010-01-27 23:18 . 2008-04-14 10:00 81362 ----a-w- c:\windows\system32\perfc016.dat

2010-01-27 23:18 . 2008-04-14 10:00 474168 ----a-w- c:\windows\system32\perfh016.dat

2010-01-20 21:52 . 2010-01-20 21:52 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\InstallShield

2010-01-20 21:47 . 2010-01-20 21:47 -------- d-----w- c:\arquivos de programas\Realtek

2010-01-20 21:47 . 2010-01-20 21:47 -------- d--h--w- c:\arquivos de programas\InstallShield Installation Information

2010-01-20 21:47 . 2010-01-20 21:47 315392 ----a-w- c:\windows\HideWin.exe

2010-01-20 21:47 . 2010-01-20 21:47 -------- d-----w- c:\arquivos de programas\Arquivos comuns\InstallShield

2010-01-20 21:45 . 2010-01-20 21:45 552 ----a-w- c:\windows\system32\d3d8caps.dat

2010-01-20 21:42 . 2010-01-20 21:42 -------- d-----w- c:\arquivos de programas\microsoft frontpage

2010-01-20 21:40 . 2010-01-20 21:40 -------- d-----w- c:\arquivos de programas\Serviços on-line

2010-01-20 21:39 . 2010-01-20 21:39 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Serviços

2010-01-20 21:36 . 2010-01-20 21:36 21844 ----a-w- c:\windows\system32\emptyregdb.dat

2009-12-21 19:08 . 2008-04-14 10:00 916480 ------w- c:\windows\system32\wininet.dll

2009-12-14 16:26 . 2009-12-14 16:26 131072 --sha-r- c:\windows\system32\apcantar.dll

2009-11-21 15:58 . 2008-04-14 10:00 471552 ----a-w- c:\windows\AppPatch\aclayers.dll

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

Nota entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{fe379c63-1156-4c8c-8dbb-f823d3ea4b37}"= "c:\arquivos de programas\MAX_BR\tbMAX_.dll" [2009-11-09 2331672]

"{f4c23ca5-ed6c-4376-80ad-62f9161a7286}"= "c:\arquivos de programas\Online_Radio_Brazil\tbOnli.dll" [2009-12-31 2349080]

"{9b339f6e-ddcd-401b-8764-230adbd01761}"= "c:\arquivos de programas\Messenger_Plus_Live\tbMess.dll" [2009-12-31 2349080]

[HKEY_CLASSES_ROOT\clsid\{fe379c63-1156-4c8c-8dbb-f823d3ea4b37}]

[HKEY_CLASSES_ROOT\clsid\{f4c23ca5-ed6c-4376-80ad-62f9161a7286}]

[HKEY_CLASSES_ROOT\clsid\{9b339f6e-ddcd-401b-8764-230adbd01761}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9b339f6e-ddcd-401b-8764-230adbd01761}]

2009-12-31 13:53 2349080 ----a-w- c:\arquivos de programas\Messenger_Plus_Live\tbMess.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f4c23ca5-ed6c-4376-80ad-62f9161a7286}]

2009-12-31 13:53 2349080 ----a-w- c:\arquivos de programas\Online_Radio_Brazil\tbOnli.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fe379c63-1156-4c8c-8dbb-f823d3ea4b37}]

2009-11-09 20:38 2331672 ----a-w- c:\arquivos de programas\MAX_BR\tbMAX_.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{fe379c63-1156-4c8c-8dbb-f823d3ea4b37}"= "c:\arquivos de programas\MAX_BR\tbMAX_.dll" [2009-11-09 2331672]

"{f4c23ca5-ed6c-4376-80ad-62f9161a7286}"= "c:\arquivos de programas\Online_Radio_Brazil\tbOnli.dll" [2009-12-31 2349080]

"{9b339f6e-ddcd-401b-8764-230adbd01761}"= "c:\arquivos de programas\Messenger_Plus_Live\tbMess.dll" [2009-12-31 2349080]

[HKEY_CLASSES_ROOT\clsid\{fe379c63-1156-4c8c-8dbb-f823d3ea4b37}]

[HKEY_CLASSES_ROOT\clsid\{f4c23ca5-ed6c-4376-80ad-62f9161a7286}]

[HKEY_CLASSES_ROOT\clsid\{9b339f6e-ddcd-401b-8764-230adbd01761}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{FE379C63-1156-4C8C-8DBB-F823D3EA4B37}"= "c:\arquivos de programas\MAX_BR\tbMAX_.dll" [2009-11-09 2331672]

"{F4C23CA5-ED6C-4376-80AD-62F9161A7286}"= "c:\arquivos de programas\Online_Radio_Brazil\tbOnli.dll" [2009-12-31 2349080]

"{9B339F6E-DDCD-401B-8764-230ADBD01761}"= "c:\arquivos de programas\Messenger_Plus_Live\tbMess.dll" [2009-12-31 2349080]

[HKEY_CLASSES_ROOT\clsid\{fe379c63-1156-4c8c-8dbb-f823d3ea4b37}]

[HKEY_CLASSES_ROOT\clsid\{f4c23ca5-ed6c-4376-80ad-62f9161a7286}]

[HKEY_CLASSES_ROOT\clsid\{9b339f6e-ddcd-401b-8764-230adbd01761}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="c:\arquivos de programas\Windows Live\Messenger\msnmsgr.exe" [2010-01-21 3945280]

"SUPERAntiSpyware"="c:\arquivos de programas\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-01-05 2002160]

"Skype"="c:\arquivos de programas\Skype\Phone\Skype.exe" [2009-10-09 25623336]

"ares"="c:\arquivos de programas\Ares\Ares.exe" [2010-01-22 1011712]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDCPL"="RTHDCPL.EXE" [2009-03-08 16862208]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-08 8466432]

"nwiz"="nwiz.exe" [2009-03-08 1626112]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-08 81920]

"TkBellExe"="c:\arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" [2010-01-21 321040]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]

"{AFB2733D-4ED6-483F-B296-8D33A8843230}"= "c:\windows\system32\apcantar.dll" [2009-12-14 131072]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\arquivos de programas\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2009-09-03 16:21 548352 ----a-w- c:\arquivos de programas\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 3]

2010-01-06 17:33 2335952 ----a-w- c:\arquivos de programas\IObit\Advanced SystemCare 3\AWC.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]

2008-04-14 10:00 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]

2006-10-27 02:47 92456 ----a-w- c:\arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

2010-01-21 12:39 1695232 ------w- c:\arquivos de programas\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]

2010-01-21 12:35 3945280 ----a-w- c:\arquivos de programas\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]

2009-03-08 21:30 81920 ----a-w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]

2010-01-27 10:08 1217808 ----a-w- c:\arquivos de programas\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2010-01-11 17:21 246504 ----a-w- c:\arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

2010-01-21 04:47 321040 ----a-w- c:\arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\WINDOWS\\RTHDCPL.EXE"=

"c:\\Arquivos de programas\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Arquivos de programas\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\WINDOWS\\system32\\MSIEXEC.EXE"=

"c:\\Arquivos de programas\\VMware\\VMware Workstation\\vmware-authd.exe"=

"c:\\Arquivos de programas\\1264023843\\USER1264023843L.exe"=

"c:\\Arquivos de programas\\VMware\\VMware Workstation\\vmware-vmx.exe"=

"c:\\Arquivos de programas\\Microsoft Office\\Office12\\GrooveMonitor.exe"=

"c:\\WINDOWS\\system32\\taskmgr.exe"=

"c:\\Arquivos de programas\\Windows Media Player\\wmplayer.exe"=

"c:\\WINDOWS\\system32\\drwtsn32.exe"=

"c:\\Arquivos de programas\\Arquivos comuns\\Real\\Update_OB\\realsched.exe"=

"c:\\Arquivos de programas\\Mozilla Firefox\\firefox.exe"=

"c:\\Documents and Settings\\Administrador\\temp\\TeamViewer\\Version5\\TeamViewer.exe"=

"c:\\Arquivos de programas\\Steam\\Steam.exe"=

"c:\\Arquivos de programas\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\Arquivos de programas\\Skype\\Phone\\Skype.exe"=

R1 SASDIFSV;SASDIFSV;c:\arquivos de programas\SUPERAntiSpyware\sasdifsv.sys [5/1/2010 07:56 9968]

R1 SASKUTIL;SASKUTIL;c:\arquivos de programas\SUPERAntiSpyware\SASKUTIL.SYS [5/1/2010 07:56 74480]

R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\arquivos de programas\Firebird\Firebird_2_1\bin\fbguard.exe -s DefaultInstance --> c:\arquivos de programas\Firebird\Firebird_2_1\bin\fbguard.exe -s DefaultInstance [?]

R2 Vcs;Vcs support;c:\windows\system32\drivers\Vcs.sys [26/1/2010 21:52 6852]

R2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys [22/10/2009 05:00 70704]

R2 VMUSBArbService;VMware USB Arbitration Service;c:\arquivos de programas\Common Files\VMware\USB\vmware-usbarbitrator.exe [22/10/2009 03:47 563760]

R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\system32\drivers\A3AB.sys [20/1/2010 20:00 472096]

R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\arquivos de programas\Firebird\Firebird_2_1\bin\fbserver.exe -s DefaultInstance --> c:\arquivos de programas\Firebird\Firebird_2_1\bin\fbserver.exe -s DefaultInstance [?]

R3 SASENUM;SASENUM;c:\arquivos de programas\SUPERAntiSpyware\SASENUM.SYS [5/1/2010 07:56 7408]

R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\drivers\vcsvad.sys [26/1/2010 21:38 17792]

S2 .1264023843;1264023843;c:\arquivos de programas\1264023843\USER1264023843L.exe [10/9/2009 02:44 484456]

S3 ddsxeiservice;ddsxeiservice2;c:\arquivos de programas\sXe Injected\ddsxei.sys [28/11/2009 22:38 94080]

Conteúdo da pasta 'Tarefas Agendadas'

2010-01-28 c:\windows\Tasks\User_Feed_Synchronization-{2D4863DE-4B39-4882-AA7A-2B95A52A89E3}.job

c:\windows\system32\msfeedssync.exe [2009-03-08 06:31]

------- Scan Suplementar -------

mWindow Title =

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~4\Office12\EXCEL.EXE/3000

LSP: c:\arquivos de programas\VMware\VMware Workstation\vsocklib.dll

TCP: {D2DCB7B9-803F-4036-BCE0-B8A66606E4B7} = 208.67.222.222,208.67.220.220

TCP: {DC811895-81B2-4D4B-A085-C0CBEC145284} = 192.168.0.1

FF - ProfilePath - c:\documents and settings\Administrador\Dados de aplicativos\Mozilla\Firefox\Profiles\j9zm4057.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.webradioagitomix.net/

FF - component: c:\arquivos de programas\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "[http://www.firefox.com"](http://www.firefox.com));

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

.

- - - ORFÃOS REMOVIDOS - - - -

MSConfigStartUp-system - c:\windows\svcr.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-01-28 21:00

Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------

[HKEY_USERS\S-1-5-21-1123561945-1993962763-1708537768-500\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (Administrator)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f9,b9,e7,17,7f,d3,d9,41,bd,45,76,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f9,b9,e7,17,7f,d3,d9,41,bd,45,76,\

"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f9,b9,e7,17,7f,d3,d9,41,bd,45,76,\

--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - > 'winlogon.exe'(740)

c:\arquivos de programas\SUPERAntiSpyware\SASWINLO.dll

c:\windows\system32\WININET.dll

- - - - - - > 'explorer.exe'(200)

c:\windows\system32\WININET.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\apcantar.dll

------------------------ Outros Processos em Execução ------------------------

c:\arquivos de programas\Firebird\Firebird_2_1\bin\fbguard.exe

c:\arquivos de programas\Java\jre6\bin\jqs.exe

c:\windows\system32\nvsvc32.exe

c:\windows\RTHDCPL.EXE

c:\windows\system32\RUNDLL32.EXE

c:\windows\system32\vmnat.exe

c:\windows\system32\vmnetdhcp.exe

c:\arquivos de programas\VMware\VMware Workstation\vmware-authd.exe

c:\arquivos de programas\Firebird\Firebird_2_1\bin\fbserver.exe

c:\arquivos de programas\Skype\Plugin Manager\skypePM.exe

**************************************************************************

Tempo para conclusão: 2010-01-28 21:04:49 - Máquina reiniciou

ComboFix-quarantined-files.txt 2010-01-28 23:04

Pré-execução: 12 pasta(s) 43.393.900.544 bytes disponíveis

Pós execução: 13 pasta(s) 43.527.983.104 bytes disponíveis

- End Of File - - 40DAB59A586EA75FAD39021E0DBF2493

###################################################################

Ad-Report-CLEAN

======= LOGFILE OF AD-REMOVER 1.1.4.6_I | ONLY XP/VISTA/7 =======

Updated by C_XX on 28.01.2010 at 18:26

Contact: AdRemover.contact@gmail.com

Website: http://pagesperso-orange.fr/NosTools/ad_remover.html

Launch at: 20:40:47, qui 28/01/2010 | Normal Boot | Option: CLEAN

Executed from: C:\Ad-Remover\

Operating system: Microsoft® Windows XP™ Service Pack 3 versÆo 5.1.2600

Computer Name: USER-9876513123 | Current user: Administrador

============== NEUTRALIZED ELEMENT(S) ==============

(!) -- Temp files deleted.

HKCU\software\microsoft\internet explorer\searchscopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0E5CBF21-D15F-11D0-8301-00AA005B4383}

============== Added scan ==============

Mozilla FireFox Version 3.6 [pt-BR]

ProfilePath: j9zm4057.default (Administrador)

(ADMINI~1, prefs.js) Browser.download.lastDir, C:\Documents and Settings\Administrador\Meus documentos

(ADMINI~1, prefs.js) Browser.startup.homepage, hxxp://www.webradioagitomix.net/

(ADMINI~1, prefs.js) Extensions.enabledItems, {20a82645-c095-46ed-80e3-08825760534b}:1.1,{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}:6.0.18,jqs@sun.com:1.0,{B13721C7-F507-4982-B2E5-502A71474FED}:3.3.0.3971,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6

Internet Explorer Version 8.0.6001.18702

[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Do404Search: 01000000

Local Page: C:\WINDOWS\system32\blank.htm

Show_ToolBar: yes

Start Page: hxxp://fr.msn.com/

Enable Browser Extensions: yes

Use Search Asst: no

Default_search_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

Default_page_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896

[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

Delete_Temp_Files_On_Exit: yes

Local Page: C:\WINDOWS\system32\blank.htm

Start Page: hxxp://fr.msn.com/

Search bar: hxxp://search.msn.com/spbasic.htm

[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

Tabs: res://ieframe.dll/tabswelcome.htm

============== Suspect (Cracks, Serials, ...) ==============

C:\Documents and Settings\Administrador\Desktop\leonardo\programas\VMWARE +keygen\vmware_7_keygen.zip

C:\Documents and Settings\Administrador\Desktop\leonardo\programas\VMWARE +keygen\VMware-workstation-full-7.0.0-203739.exe

===================================

2831 Byte(s) - C:\Ad-Report-CLEAN[1].log

2819 Byte(s) - C:\Ad-Report-SCAN[1].log

350 File(s) - C:\DOCUME~1\ADMINI~1\CONFIG~1\Temp

21 File(s) - C:\WINDOWS\Temp

0 File(s) - C:\WINDOWS\Prefetch

19 File(s) - C:\Ad-Remover\BACKUP

0 File(s) - C:\Ad-Remover\QUARANTINE

End at: 20:45:53 | qui 28/01/2010 - CLEAN[1]

============== E.O.F ==============

###################################

ToolbarSD\TB_1.txt

-----------\\ ToolBar S&D 1.2.9 XP/Vista

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3

X86-based PC ( Uniprocessor Free : AMD Sempron Processor LE-1250 )

BIOS : )Phoenix - Award WorkstationBIOS v6.00PG

USER : Administrador ( Administrator )

BOOT : Normal boot

C:\ (Local Disk) - NTFS - Total:74 Go (Free:40 Go)

D:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )

Option : [1] ( qui 28/01/2010|20:50 )

-----------\\ Procura por Arquivos / Ficheiros ...

-----------\\ Extensions

 (Administrador) - {20a82645-c095-46ed-80e3-08825760534b} => chrome_user

 

 

 -----------\\ [..\Internet Explorer\Main]

 

 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

 "Local Page"="C:\\WINDOWS\\system32\\blank.htm"

 "Start Page"="http://fr.msn.com/"'>[http://fr.msn.com/](http://fr.msn.com/)"

 "Default_search_url"="[http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"](http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch)

 "Default_page_url"="[http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"](http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome)

 "Search bar"="[http://go.microsoft.com/fwlink/?linkid=54896"](http://go.microsoft.com/fwlink/?linkid=54896)

 "Url"="[http://go.microsoft.com/fwlink/?LinkId=75724"](http://go.microsoft.com/fwlink/?LinkId=75724)

 "Url"="[http://go.microsoft.com/fwlink/?LinkId=75723"](http://go.microsoft.com/fwlink/?LinkId=75723)

 

 [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]

 "Default_Page_URL"="[http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"](http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome)

 "Default_Search_URL"="[http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"](http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch)

 "Search Page"="[http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"](http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch)

 "Local Page"="C:\\WINDOWS\\system32\\blank.htm"

 "Start Page"="http://fr.msn.com/"'>[http://fr.msn.com/](http://fr.msn.com/)"

 "Search bar"="[http://search.msn.com/spbasic.htm"](http://search.msn.com/spbasic.htm)

 

 

 --------------------\\ Procurando por outras infecções

 

 --------------------\\ Cracks & Keygens ..

 

 C:\DOCUME~1\ADMINI~1\Desktop\leonardo\programas\VMWARE +keygen

 C:\DOCUME~1\ADMINI~1\Desktop\leonardo\programas\VMWARE +keygen\VMware-workstation-full-7.0.0-203739.exe

 C:\DOCUME~1\ADMINI~1\Desktop\leonardo\programas\VMWARE +keygen\vmware_7_keygen.zip

 

 

 

 1 - "C:\ToolBar SD\TB_1.txt" - qui 28/01/2010|20:50 - Option : [1]

Bom meu PC deu uma melhorada !

Mais continua lento :x

Já ia esqueçendo log hijackthis.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:15:07, on 28/1/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Firebird\Firebird_2_1\bin\fbguard.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Common Files\VMware\USB\vmware-usbarbitrator.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\WINDOWS\system32\vmnat.exe

C:\Arquivos de programas\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\WINDOWS\system32\vmnetdhcp.exe

C:\Arquivos de programas\Skype\Phone\Skype.exe

C:\Arquivos de programas\Ares\Ares.exe

C:\Arquivos de programas\VMware\VMware Workstation\vmware-authd.exe

C:\Arquivos de programas\Firebird\Firebird_2_1\bin\fbserver.exe

C:\Arquivos de programas\Skype\Plugin Manager\skypePM.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\explorer.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\Skype\Toolbars\Shared\SkypeNames.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Documents and Settings\Administrador\Meus documentos\Downloads\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896