Publicado em 15 de mai.

[Arquivado] Pc Lento

Olá pessoal, estou criando este topico para dizer que meu pc do nada começou a ficar lento na inicialização. Até ontem ele iniciava em cerca de 35 segundos, naquela parte que fica processando o windows exp com as barrinhas passando era muito ligeiro e agora do nada ta muito lento. A unica coisa que eu percebi de estranho nele foi que quando eu inicio um jogo chamado RisingForce Online, antigamente ele entrava em modo full screen normal e agora ele abre uma janela do windows chamada "Active Movie Window". De resto não percebi nenhuma diferença... vou enviar o log do hijack e peço que por favor me ajudem. Abraços e fiquem com Deus.

Log do Hijack:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:16:04, on 15/5/2010

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

C:\WINDOWS\System32\PAStiSvc.exe

C:\WINDOWS\system32\svchost.exe

C:\ARQUIV~1\AVG\AVG8\avgemc.exe

C:\ARQUIV~1\AVG\AVG8\avgrsx.exe

C:\ARQUIV~1\AVG\AVG8\avgnsx.exe

C:\Arquivos de programas\AVG\AVG8\avgcsrvx.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\Explorer.exe

C:\WINDOWS\system32\WgaTray.exe

C:\WINDOWS\system32\csrcs.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe

C:\ARQUIV~1\AVG\AVG8\avgtray.exe

C:\Arquivos de programas\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Malwarebytes' Anti-Malware\mbam.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Hijack\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll

R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

F2 - REG:system.ini: Shell=Explorer.exe csrcs.exe

O1 - Hosts: 255.255.255.255 easyanticheat.se # misleading site

O1 - Hosts: 255.255.255.255 www.easyanticheat.se # misleading site

O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG8\avgssie.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar1.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar1.dll

O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [RemoteControl] "C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [LanguageShortcut] "C:\Arquivos de programas\CyberLink\PowerDVD\Language\Language.exe"

O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARQUIV~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\RunServices: [csrcs] C:\WINDOWS\system32\csrcs.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKLM\..\Policies\Explorer\Run: [csrcs] C:\WINDOWS\system32\csrcs.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Arquivos de programas\PokerStars\PokerStarsUpdate.exe

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Arquivos de programas\PartyGaming.Net\PartyPokerNet\RunPF.exe

O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Arquivos de programas\PartyGaming.Net\PartyPokerNet\RunPF.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Arquivos de programas\AVG\AVG8\avgpp.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

End of file - 7749 bytes

DigRam meu amigo, se estiver por ae, você que ja conhece bem meu pc rs. ajuda plx :)

Discussão (17)

Entre ou cadastre-se para participar da discussão

Entrar Criar conta

Power Max· 18 de mai.

:) Olá Iceds!

:seta: Sugiro que você salve ou imprima essas instruções abaixo, pois em alguns momentos você poderá precisar usar o computador sem o acesso à internet:

Faça o download do ComboFix

Salve-o no Desktop (área de trabalho).

* Desabilite as proteções residente de: antivírus, antispywares e firewall ( menos o do Windows! )

* Feche todas as janelas e execute a ferramenta.

* Ps: A execução, por comando, também é possível:

* Vá em Iniciar --> Executar --> Digite ou cole:

"%userprofile%\desktop\Combofix.exe" /killall

/applications/core/interface/imageproxy/imageproxy.php?img=http://img181.imageshack.us/img181/5825/combofixejr8.gif&key=0d882a59a7a65b06e1b50e837804afc9002b25433ef74e0c3f66f43a58058f7b" alt="combofixejr8.gif" />

* Clique em Ok.

* Na solicitação: "Negação de garantia de software" --> Clique em Sim.

/applications/core/interface/imageproxy/imageproxy.php?img=http://img.photobucket.com/albums/v706/ried7/RcAuto1.gif&key=0010234c6eff8b98a829fe5910d3fd47cc8c551f0c1836fc4748c11079a71d03" alt="RcAuto1.gif" />

* Não possuindo o "'>http://support.microsoft.com/kb/307654/pt-br"]Console de Recuperação",aceite optar pela instalação do mesmo.

* Terminando,clique Sim ou Yes. --> Aguarde.

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

:!: Caso aconteça a notificação de: Aplicativo Win32 inválido ou alguma mensagem parecida com esta, delete a ferramenta ComboFix.exe e faça, novamente, seu download.

* Salve-a no Desktop,renomeada como: Kombo.exe

* Ps: Nomeie durante o salvamento,e não após salvá-la!

* Ps: Surgindo alguma mensagem de erro, rode o ComboFix.exe em "'>http://dicasetutoriaisparapc.blogspot.com/2009/11/ferramentas-para-reparar-o-modo-seguro.html"]Modo Seguro". <-- Link!

* Ps: Na presença de atividades rootkit,teremos a seguinte janela de notificação:

/applications/core/interface/imageproxy/imageproxy.php?img=http://img.photobucket.com/albums/v666/sUBs/Rookit_found.gif&key=eb1b849776e4208479b15adbf0e86845810495533720ff18c63647e4d0943f29" alt="Rookit_found.gif" />

* Ps: Anote essas detecções, e dê o OK. Neste caso poste estas detecções que você terá anotado em sua próxima resposta juntamente com os logs pedidos.

* Ps: Para completar as remoções, talvez haja necessidade da ferramenta reiniciar o computador. <-- Aguarde!

* Ps: Para evitar problemas, siga todas as recomendações propostas.

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

* Abrir-se-á a janela Auto Scan. --> Aguarde!

* Para finalizar remoções, o ComboFix poderá reiniciar o computador.

* Se houver necessidade, digite a opção ( 1 ) --> Aperte Enter! --> Aguarde a conclusão!

* Durante o scan, evite manusear o mouse ou teclado! <-- Importante!

* Caso, por algum motivo de força maior, precise parar ou sair do ComboFix,tecle "N" ou "2" --> Aperte Enter.

<><><><><><><><><><><><>

O log do Combofix estará em C:\ComboFix.txt

_______________________________

:seta: Siga, por gentileza, as dicas deste tutorial para fazer uma limpeza de seu PC com o Malwarebytes:

'>http://dicasetutoriaisparapc.blogspot.com/2009/10/tutorial-do-malwarebytes-anti-malware.html"]Tutorial do Malwarebytes Anti-Malware

_______________________________

:seta: Na sua próxima resposta poste este log do Malwarebytes juntamente com o log que estará em C:\ComboFix.txt e um novo log do Hijackthis e nos diga como está o seu PC após estes procedimentos.

Ficamos no aguardo.

Iceds· 20 de mai.

Olá Antonio, fiz td e vou postar os logs aki para você, desde ja agradeço, abraço.

Logo do combo.fix:

ComboFix 10-05-19.02 - user 19/05/2010 21:57:48.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.55.1046.18.2045.1394 [GMT -3:00]

Executando de: c:\documents and settings\user\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free On-access scanning disabled (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

c:\windows\system32\3753519.dll

c:\windows\system32\8893845.dll

c:\windows\system32\csrcs.exe

(((((((((((((((( Arquivos/Ficheiros criados de 2010-04-20 to 2010-05-20 ))))))))))))))))))))))))))))

2010-05-20 00:17 . 2004-08-04 03:45 82944 ---h-tw- c:\windows\system32\88475aa.dll

2010-05-20 00:17 . 2004-08-04 03:45 82944 ---h-tw- c:\windows\system32\69f5988.dll

2010-05-20 00:15 . 2004-08-04 03:45 82944 ---h-tw- c:\windows\system32\77aae86.dll

2010-05-20 00:15 . 2004-08-04 03:45 82944 ---h-tw- c:\windows\system32\2f156680.dll

2010-05-19 23:58 . 2004-08-04 03:45 82944 ---h-tw- c:\windows\system32\91eefc0.dll

2010-05-19 23:58 . 2004-08-04 03:45 82944 ---h-tw- c:\windows\system32\2fa3b85e.dll

2010-05-19 23:16 . 2004-08-04 03:45 82944 ---h-tw- c:\windows\system32\805557a.dll

2010-05-19 22:58 . 2004-08-04 03:45 82944 ---h-tw- c:\windows\system32\a0bcd4c.dll

2010-05-19 22:58 . 2004-08-04 03:45 82944 ---h-tw- c:\windows\system32\1d77b898.dll

2010-05-19 22:56 . 2004-08-04 03:45 82944 ---h-tw- c:\windows\system32\40f9ce.dll

2010-05-19 22:56 . 2004-08-04 03:45 82944 ---h-tw- c:\windows\system32\1a5b3588.dll

2010-05-19 22:50 . 2004-08-04 03:45 82944 ---h-tw- c:\windows\system32\f543864.dll

2010-05-19 22:50 . 2004-08-04 03:45 82944 ---h-tw- c:\windows\system32\8d163ec.dll

2010-05-19 20:59 . 2004-08-04 03:45 82944 ---h-tw- c:\windows\system32\cbf24d2.dll

2010-05-19 20:59 . 2004-08-04 03:45 82944 ---h-tw- c:\windows\system32\2a1b8736.dll

2010-05-19 19:25 . 2004-08-04 03:45 82944 ---h-tw- c:\windows\system32\fc49800.dll

2010-05-19 19:25 . 2004-08-04 03:45 82944 ---h-tw- c:\windows\system32\37813da6.dll

2010-05-19 19:08 . 2004-08-04 03:45 82944 ---h-tw- c:\windows\system32\30a63940.dll

2010-05-19 19:08 . 2004-08-04 03:45 82944 ---h-tw- c:\windows\system32\258e556.dll

2010-05-17 23:01 . 2010-05-17 23:04 -------- d-----w- c:\arquivos de programas\Satsuki Decoder Pack

2010-05-17 22:00 . 2010-05-17 22:00 -------- d-----w- c:\documents and settings\user\Dados de aplicativos\TeamViewer

2010-05-17 22:00 . 2010-05-17 22:00 -------- d-----w- c:\documents and settings\user\temp

2010-05-17 19:28 . 2010-05-17 19:28 -------- d-----w- c:\documents and settings\user\Dados de aplicativos\Publish Providers

2010-05-17 19:28 . 2010-05-17 22:10 -------- d-----w- c:\documents and settings\user\Dados de aplicativos\Sony

2010-05-17 19:26 . 2010-05-17 19:26 -------- d-----w- c:\arquivos de programas\Vstplugins

2010-05-17 19:26 . 2010-05-17 19:26 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Sony

2010-05-06 11:42 . 2010-05-06 11:42 -------- d-----w- c:\windows\system32\Nova pasta

2010-05-02 00:25 . 2010-05-02 00:25 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\nView_Profiles

2010-04-25 01:33 . 2010-04-25 01:33 85504 ----a-w- c:\windows\system32\ff_vfw.dll

2010-04-22 15:49 . 2010-04-22 15:49 -------- d-----w- c:\documents and settings\user\Dados de aplicativos\dvdcss

2010-04-22 15:36 . 2010-05-17 22:58 -------- d-----w- c:\documents and settings\user\Dados de aplicativos\vlc

2010-04-22 15:35 . 2010-04-22 15:35 -------- d-----w- c:\arquivos de programas\VideoLAN

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

2010-05-18 15:39 . 2010-04-17 14:08 -------- d-----w- c:\documents and settings\user\Dados de aplicativos\TS3Client

2010-05-15 06:10 . 2008-05-05 05:56 -------- d-----w- c:\documents and settings\user\Dados de aplicativos\Skype

2010-05-15 04:14 . 2008-05-05 05:56 -------- d-----w- c:\documents and settings\user\Dados de aplicativos\skypePM

2010-05-12 10:26 . 2010-04-11 15:56 -------- d-----w- c:\documents and settings\user\Dados de aplicativos\Dropbox

2010-05-10 18:19 . 2008-01-19 07:30 -------- d-----w- c:\arquivos de programas\Tibia

2010-05-09 01:02 . 2008-02-09 11:23 -------- d-----w- c:\documents and settings\user\Dados de aplicativos\LimeWire

2010-05-08 16:51 . 2008-04-24 06:10 -------- d-----w- c:\documents and settings\user\Dados de aplicativos\teamspeak2

2010-04-25 00:45 . 2009-11-29 21:53 -------- d-----w- c:\arquivos de programas\PokerStars

2010-04-11 15:57 . 2010-04-11 15:57 89831 ----a-w- c:\documents and settings\user\Dados de aplicativos\Dropbox\bin\Uninstall.exe

2010-04-05 12:13 . 2010-04-05 12:08 -------- d-----w- c:\arquivos de programas\NCSoft

2010-04-05 12:13 . 2008-01-16 16:21 -------- d--h--w- c:\arquivos de programas\InstallShield Installation Information

2010-04-05 12:07 . 2010-04-05 12:07 -------- d-----w- c:\arquivos de programas\SystemRequirementsLab

2010-03-04 10:30 . 2001-10-28 18:07 67450 ----a-w- c:\windows\system32\perfc016.dat

2010-03-04 10:30 . 2001-10-28 18:07 425426 ----a-w- c:\windows\system32\perfh016.dat

2010-03-04 10:29 . 2010-03-04 10:29 152576 ----a-w- c:\documents and settings\user\Dados de aplicativos\Sun\Java\jre1.6.0_17\lzma.dll

2010-03-04 10:29 . 2009-11-23 20:29 79488 ----a-w- c:\documents and settings\user\Dados de aplicativos\Sun\Java\jre1.6.0_17\gtapi.dll

2010-02-26 05:10 . 2010-02-26 05:10 21979992 ----a-w- c:\documents and settings\user\Dados de aplicativos\Dropbox\bin\Dropbox.exe

2009-02-11 11:41 . 2009-02-11 11:57 2576 --sha-r- c:\windows\system32\DirectX\Dinput\desktop.inf.dat

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

Nota entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]

2009-11-25 16:03 1230080 ----a-w- c:\arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2009-12-09 01:19 94208 ----a-w- c:\documents and settings\user\Dados de aplicativos\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2009-12-09 01:19 94208 ----a-w- c:\documents and settings\user\Dados de aplicativos\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2009-12-09 01:19 94208 ----a-w- c:\documents and settings\user\Dados de aplicativos\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDCPL"="RTHDCPL.EXE" [2007-06-13 16377344]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-29 8466432]

"nwiz"="nwiz.exe" [2007-06-29 1626112]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-29 81920]

"RemoteControl"="c:\arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-24 56928]

"LanguageShortcut"="c:\arquivos de programas\CyberLink\PowerDVD\Language\Language.exe" [2006-12-06 54832]

"AVG8_TRAY"="c:\arquiv~1\AVG\AVG8\avgtray.exe" [2010-03-19 2046816]

"Adobe Reader Speed Launcher"="c:\arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2010-04-02 40368]

"Adobe ARM"="c:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]

"SunJavaUpdateSched"="c:\arquivos de programas\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2009-08-31 10:36 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\Tibia\\Tibia.exe"=

"c:\\Arquivos de programas\\WinRAR\\WinRAR.exe"=

"c:\\Arquivos de programas\\Movie Maker\\moviemk.exe"=

"c:\\Arquivos de programas\\LimeWire\\LimeWire.exe"=

"c:\\Arquivos de programas\\Spybot - Search & Destroy\\SpybotSD.exe"=

"c:\\Arquivos de programas\\Real Alternative\\settings.exe"=

"c:\\WINDOWS\\system32\\mshearts.exe"=

"c:\\Arquivos de programas\\Mozilla Firefox\\firefox.exe"=

"c:\\Arquivos de programas\\Tibia\\TibiCAM\\TibiCAM.exe"=

"c:\\WINDOWS\\system32\\dpvsetup.exe"=

"c:\\Arquivos de programas\\Valve\\Steam\\SteamApps\\marcosfillus\\condition zero\\hl.exe"=

"c:\\Arquivos de programas\\Valve\\Steam\\Steam.exe"=

"c:\\Arquivos de programas\\Valve\\Steam\\SteamApps\\marcosfillus\\dedicated server\\hlds.exe"=

"c:\\CCR INC\\RFOnline\\RF.exe"=

"c:\\Arquivos de programas\\Valve\\Steam\\SteamApps\\marcosfillus\\dedicated server\\hltv.exe"=

"c:\\Arquivos de programas\\Sony Interactive\\Twisted Metal 2\\TM2.EXE"=

"c:\\Arquivos de programas\\AVG\\AVG8\\avgupd.exe"=

"c:\\Arquivos de programas\\AVG\\AVG8\\avgnsx.exe"=

"c:\\Arquivos de programas\\AVG\\AVG8\\avgemc.exe"=

"c:\\Arquivos de programas\\Valve\\Steam\\SteamApps\\marcosfillus\\day of defeat\\hl.exe"=

"e:\\Level Up! Games\\RF Online\\RF.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"e:\\Arquivos de programas\\Microsoft Games\\Age of Mythology\\aomx.exe"=

"c:\\Documents and Settings\\user\\Dados de aplicativos\\Dropbox\\bin\\Dropbox.exe"=

"c:\\Arquivos de programas\\Valve\\Steam\\SteamApps\\common\\left 4 dead 2\\srcds.exe"=

"c:\\Arquivos de programas\\Valve\\Steam\\SteamApps\\common\\oblivion\\OblivionLauncher.exe"=

"c:\\Arquivos de programas\\Valve\\Steam\\SteamApps\\common\\left 4 dead 2\\left4dead2.exe"=

"c:\\Arquivos de programas\\Valve\\Steam\\SteamApps\\marcosfillus\\counter-strike\\hl.exe"=

"c:\\Arquivos de programas\\Skype\\Phone\\Skype.exe"=

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2/12/2009 12:56 28552]

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [31/8/2009 07:36 335240]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [31/8/2009 07:36 108552]

R2 avg8emc;AVG Free8 E-mail Scanner;c:\arquiv~1\AVG\AVG8\avgemc.exe [31/8/2009 07:36 908056]

R2 avg8wd;AVG Free8 WatchDog;c:\arquiv~1\AVG\AVG8\avgwdsvc.exe [31/8/2009 07:36 297752]

S3 PAC207;VideoCAM GF112;c:\windows\system32\drivers\PFC027.sys [8/4/2005 19:46 162176]

------- Scan Suplementar -------

uStart Page = hxxp://www.google.com/

mStart Page = hxxp://www.google.com

mWindow Title =

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\user\Dados de aplicativos\Mozilla\Firefox\Profiles\qcm48twq.default\

---- FIREFOX POLICIES ----

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

.

- - - ORFÃOS REMOVIDOS - - - -

AddRemove-Juliana Góes - c:\arquivos de programas\Juliana Góes\Uninstall.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-05-19 22:01

Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

Tempo para conclusão: 2010-05-19 22:02:22

ComboFix-quarantined-files.txt 2010-05-20 01:02

Pré-execução: 18 pasta(s) 12.918.530.048 bytes disponíveis

Pós execução: 20 pasta(s) 13.663.846.400 bytes disponíveis

- End Of File - - 3C45894915215377093469058482A50C

Log do Malware~:

Malwarebytes' Anti-Malware 1.34

Versão do banco de dados: 1879

Windows 5.1.2600 Service Pack 2

19/5/2010 22:06:41

mbam-log-2010-05-19 (22-06-41).txt

Tipo de Verificação: Rápida

Objetos verificados: 67519

Tempo decorrido: 2 minute(s), 11 second(s)

Processos da Memória infectados: 0

Módulos de Memória Infectados: 0

Chaves do Registro infectadas: 0

Valores do Registro infectados: 0

Ítens do Registro infectados: 0

Pastas infectadas: 0

Arquivos infectados: 0

Processos da Memória infectados:

(Nenhum ítem malicioso foi detectado)

Módulos de Memória Infectados:

(Nenhum ítem malicioso foi detectado)

Chaves do Registro infectadas:

(Nenhum ítem malicioso foi detectado)

Valores do Registro infectados:

(Nenhum ítem malicioso foi detectado)

Ítens do Registro infectados:

(Nenhum ítem malicioso foi detectado)

Pastas infectadas:

(Nenhum ítem malicioso foi detectado)

Arquivos infectados:

(Nenhum ítem malicioso foi detectado)

Log do Hijack atualizado:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:07:22, on 19/5/2010

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

C:\WINDOWS\System32\PAStiSvc.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe

C:\Arquivos de programas\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\system32\WgaTray.exe

C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

C:\ARQUIV~1\AVG\AVG8\avgemc.exe

C:\Arquivos de programas\AVG\AVG8\avgcsrvx.exe

C:\ARQUIV~1\AVG\AVG8\avgnsx.exe

C:\ARQUIV~1\AVG\AVG8\avgrsx.exe

C:\WINDOWS\explorer.exe

C:\Arquivos de programas\AVG\AVG8\avgtray.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\Teamspeak2_RC2\TeamSpeak.exe