[Resolvido!]Páginas abrem sozinhas....

Misslu · Janeiro 11, 2006

Olá,

Passei a tarde de hoje a rodar todos os programas e nada... O sistema continua lento e as páginas da net abrem sozinhas. Abro uma, e mais umas tantas abrem sozinhas ( mediapurchases.com, etc...)

Tenho o Kaspersky anti virus personal, e já rodei adware, spybot. etc...

Alguém pode analisar o meu Log?

Pleaaaaaaaaaaaaaaaase!!!!!!!!!

Agradeço desde já quem me ajudar.

Lú

Logfile of HijackThis v1.99.1

Scan saved at 17:49:36, on 11/1/2006

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:

D:\WINDOWS\System32\smss.exe

D:\WINDOWS\system32\winlogon.exe

D:\WINDOWS\system32\services.exe

D:\WINDOWS\system32\lsass.exe

D:\WINDOWS\System32\Ati2evxx.exe

D:\WINDOWS\system32\svchost.exe

D:\WINDOWS\System32\svchost.exe

D:\WINDOWS\System32\brsvc01a.exe

D:\WINDOWS\System32\brss01a.exe

D:\WINDOWS\system32\spoolsv.exe

D:\WINDOWS\system32\Brmfrmps.exe

D:\Arquivos de programas\ewido anti-malware\ewidoctrl.exe

D:\Arquivos de programas\ewido anti-malware\ewidoguard.exe

D:\WINDOWS\System32\inetsrv\inetinfo.exe

D:\WINDOWS\System32\LckFldService.exe

D:\WINDOWS\System32\snmp.exe

D:\WINDOWS\System32\svchost.exe

D:\WINDOWS\System32\mqsvc.exe

D:\WINDOWS\System32\mqtgsvc.exe

D:\WINDOWS\system32\rundll32.exe

D:\WINDOWS\Explorer.EXE

D:\WINDOWS\System32\ctfmon.exe

D:\WINDOWS\helper.exe

D:\Defesa\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pt/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - Default URLSearchHook is missing

O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [KAVPersonal50] "D:\Arquivos de programas\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize

O4 - HKLM\..\RunServices: [Windows Debugger] windbg32.exe

O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://D:\ARQUIV~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Arquivos de programas\Java\jre1.5.0_02\bin\npjpi150_02.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Arquivos de programas\Java\jre1.5.0_02\bin\npjpi150_02.dll

O10 - Unknown file in Winsock LSP: d:\arquivos de programas\bonjour\mdnsnsp.dll

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/MediaAcc...Bridge-c139.cab

O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} - http://www.azebar.com/install/azesearch.cab

O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by112fd.bay112.hotmail.msn.com/activex/HMAtchmt.ocx

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\ARQUIV~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - Winlogon Notify: IntlRun - D:\WINDOWS\system32\gpl6l33s1.dll

O20 - Winlogon Notify: msctl32.dll - D:\WINDOWS\

O21 - SSODL: TapiSrv - {01FF440B-15A8-C989-80E4-A2B392CDA354} - D:\WINDOWS\help\tapi.hlp

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Bonjour Service - Apple Computer, Inc. - D:\Arquivos de programas\Bonjour\mDNSResponder.exe

O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - D:\WINDOWS\system32\Brmfrmps.exe" -service (file missing)

O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - D:\WINDOWS\System32\brsvc01a.exe

O23 - Service: ewido security suite control - ewido networks - D:\Arquivos de programas\ewido anti-malware\ewidoctrl.exe

O23 - Service: ewido security suite guard - ewido networks - D:\Arquivos de programas\ewido anti-malware\ewidoguard.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Unknown owner - D:\Arquivos de programas\iPod\bin\iPodService.exe (file missing)

O23 - Service: kavsvc - Kaspersky Lab - D:\Arquivos de programas\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe

O23 - Service: LckFldService - Unknown owner - D:\WINDOWS\System32\LckFldService.exe

jgarcia · Janeiro 11, 2006

Cara Misslu,

Ainda há o que fazer. Vamos lá.

1ª Etapa

Execute o HijackThis, clique em Do a system scan only e marque:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,

O20 - Winlogon Notify: App Management - D:\WINDOWS\system32\h60q0gd5e60.dll (file missing)

Clique em Fix Checked.

2ª Etapa

Execute o CWShredder novamente.

3ª Etapa

Rode o arquivo l2mfix.bat, aperte <Enter>, então digite 2 e aperte Enter novamente. Depois disso, você deverá apertar qualquer tecla e o computador será reiniciado.

Após reiniciar, sua área de trabalho deve sumir e reaparecer. A correção ainda não terminou. Quando ela terminar o Bloco de Notas deve abrir com um log. Anexe este log na sua resposta como você fez antes, junto com um novo log do HijackThis.

Vá até a pasta l2mfix que foi criada e copie o arquivo ntrights para o C:\

Clique em Iniciar --> Executar, digite cmd e clique em OK. Um prompt de comando vai aparecer.

Digite o seguinte:

cd c:\

Dê Enter. Agora digite o seguinte comando:

ntrights -u Administradores +r SeDebugPrivilege > log.txt

Atenção --> Certifique-se digitar este comando corretamente.

Dê Enter novamente. Agora deverá existir um arquivo chamado c:\log.txt. Abra-o e cole o conteúdo aqui.

Aguardo retorno.

Um abraço.

Misslu · Janeiro 12, 2006

Olá, jgarcia

Primeiro, obrigada pela ajuda....

Já fiz tudo e aí vão os logs.

Bem, as páginas já não abrem.... ufa!!!! Mas fiquei com o meu Windows XP igual ao 98 ): ??!!

Ah! E o l2mfix deu duas mensagens de erro, a dizer que não encontrava cmd.exe ??!!

Logfile of HijackThis v1.99.1

Scan saved at 15:06:57, on 12/1/2006

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:

D:\WINDOWS\System32\smss.exe

D:\WINDOWS\system32\winlogon.exe

D:\WINDOWS\system32\services.exe

D:\WINDOWS\system32\lsass.exe

D:\WINDOWS\System32\Ati2evxx.exe

D:\WINDOWS\system32\svchost.exe

D:\WINDOWS\System32\svchost.exe

D:\WINDOWS\System32\brsvc01a.exe

D:\WINDOWS\system32\spoolsv.exe

D:\WINDOWS\System32\brss01a.exe

D:\WINDOWS\system32\Brmfrmps.exe

D:\Arquivos de programas\ewido anti-malware\ewidoctrl.exe

D:\Arquivos de programas\ewido anti-malware\ewidoguard.exe

D:\WINDOWS\System32\inetsrv\inetinfo.exe

D:\WINDOWS\Explorer.EXE

D:\WINDOWS\System32\LckFldService.exe

D:\WINDOWS\System32\snmp.exe

D:\WINDOWS\System32\svchost.exe

D:\Arquivos de programas\Webroot\Spy Sweeper\WRSSSDK.exe

D:\WINDOWS\System32\mqsvc.exe

D:\WINDOWS\System32\mqtgsvc.exe

D:\Arquivos de programas\Webroot\Spy Sweeper\SpySweeper.exe

D:\WINDOWS\System32\ctfmon.exe

D:\WINDOWS\helper.exe

D:\Defesa\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pt/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - Default URLSearchHook is missing

O4 - HKLM\..\Run: [KAVPersonal50] "D:\Arquivos de programas\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize

O4 - HKLM\..\Run: [spySweeper] "D:\Arquivos de programas\Webroot\Spy Sweeper\SpySweeper.exe" /startintray

O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://D:\ARQUIV~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Arquivos de programas\Java\jre1.5.0_02\bin\npjpi150_02.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Arquivos de programas\Java\jre1.5.0_02\bin\npjpi150_02.dll

O10 - Unknown file in Winsock LSP: d:\arquivos de programas\bonjour\mdnsnsp.dll

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by112fd.bay112.hotmail.msn.com/activex/HMAtchmt.ocx

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\ARQUIV~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - Winlogon Notify: App Management - D:\WINDOWS\system32\h60q0gd5e60.dll (file missing)