[Resolvido!]"Dialer"

[pteixeira 0]

Ola Pessoal, mais uma vez estou a utilizar este fantastico forúm.

 

Pessoal é o seguinte o meu PC anda estranho, quando abro o "O MEU COMPT." demora imenso tempo a localizar as pastas, esta muito lento, é muito estranho.

 

Então utilizei o Panda Active Scan (apanhou um maldito "Dialer" mas não sei se será disso)e o Hijackthis para postar os seguintes LOGS para vocês.

 

Cá vai pessoal

 

SCANONLINE

Incidência Estado Localização

 

Spyware:Cookie/Adtech Não desinfectado C:\Documents and Settings\Admin\Cookies\admin@adtech[2].txt

Spyware:Cookie/Falkag Não desinfectado C:\Documents and Settings\Admin\Cookies\admin@as1.falkag[2].txt

Spyware:Cookie/Com.com Não desinfectado C:\Documents and Settings\Admin\Cookies\admin@de.uol.com[1].txt

Spyware:Cookie/Doubleclick Não desinfectado C:\Documents and Settings\Admin\Cookies\admin@doubleclick[1].txt

Spyware:Cookie/Server.iad.Liveperson Não desinfectado C:\Documents and Settings\Admin\Cookies\admin@server.iad.liveperson[2].txt

Spyware:Cookie/Com.com Não desinfectado C:\Documents and Settings\Admin\Cookies\admin@uol.com[2].txt

Spyware:Cookie/Weborama Não desinfectado C:\Documents and Settings\Admin\Cookies\admin@weborama[1].txt

Dialer:Dialer.MIN Não desinfectado C:\Documents and Settings\Admin\Definições locais\Temporary Internet Files\Content.IE5\070X6GSP\10637-69-exe[1].exe

 

Agora vai o Hijackthis

 

Logfile of HijackThis v1.99.1

Scan saved at 12:51:59, on 11-08-2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\CTsvcCDA.exe

C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe

C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe

C:\Programas\Analog Devices\SoundMAX\SMax4PNP.exe

C:\Programas\Analog Devices\SoundMAX\Smax4.exe

C:\WINDOWS\system32\rundll32.exe

C:\Programas\Java\jre1.5.0_07\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programas\Creative\MediaSource\Detector\CTDetect.exe

C:\Programas\Google\Google Talk\googletalk.exe

C:\Programas\Messenger\msmsgs.exe

C:\Programas\Spyware Doctor\sdhelp.exe

C:\Programas\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wdfmgr.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\ntvdm.exe

C:\hijackthis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.millenniumbcp.com/SME/frameset/0,1020,2-3,00.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hiperligações

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\programas\mcafee.com\mps\mcbrhlpr.dll

O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\programas\mcafee.com\mps\popupkiller.dll

O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programas\Java\jre1.5.0_07\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programas\google\googletoolbar2.dll

O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll

O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programas\google\googletoolbar2.dll

O4 - HKLM\..\Run: [soundMAXPnP] C:\Programas\Analog Devices\SoundMAX\SMax4PNP.exe

O4 - HKLM\..\Run: [soundMAX] "C:\Programas\Analog Devices\SoundMAX\Smax4.exe" /tray

O4 - HKLM\..\Run: [McRegWiz] C:\PROGRA~1\McAfee.com\Agent\mcregwiz.exe /autorun

O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask

O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"

O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe

O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe

O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe

O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding

O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe

O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MskDetct.exe /startup

O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Programas\Java\jre1.5.0_07\bin\jusched.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Creative Detector] C:\Programas\Creative\MediaSource\Detector\CTDetect.exe /R

O4 - HKCU\..\Run: [googletalk] "C:\Programas\Google\Google Talk\googletalk.exe" /autostart

O4 - HKCU\..\Run: [MSMSGS] "C:\Programas\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [spyware Doctor] "C:\Programas\Spyware Doctor\swdoctor.exe" /Q

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: &Google Search - res://c:\programas\google\GoogleToolbar2.dll/cmsearch.html

O8 - Extra context menu item: &Translate English Word - res://c:\programas\google\GoogleToolbar2.dll/cmwordtrans.html

O8 - Extra context menu item: Backward Links - res://c:\programas\google\GoogleToolbar2.dll/cmbacklinks.html

O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programas\google\GoogleToolbar2.dll/cmcache.html

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Similar Pages - res://c:\programas\google\GoogleToolbar2.dll/cmsimilar.html

O8 - Extra context menu item: Translate Page into English - res://c:\programas\google\GoogleToolbar2.dll/cmtrans.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programas\Java\jre1.5.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programas\Java\jre1.5.0_07\bin\ssv.dll

O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe

O12 - Plugin for .jsp: C:\Programas\Internet Explorer\PLUGINS\nppdf32.dll

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{119E76B0-CEC7-45A4-B440-48378ECE107D}: NameServer = 195.23.129.126 194.79.69.222

O17 - HKLM\System\CS1\Services\Tcpip\..\{119E76B0-CEC7-45A4-B440-48378ECE107D}: NameServer = 195.23.129.126 194.79.69.222

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe

O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe

O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe

O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe

O23 - Service: McAfee SpamKiller Server (MskService) - Networks Associates Technology. Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe

O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Programas\Spyware Doctor\sdhelp.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programas\Analog Devices\SoundMAX\SMAgent.exe

 

 

Gostava q dessem uma olhada à procura de algo errado.

 

Obrigado pela ajuda.

Até sempre.

[Sam Spade 2]

Olá pteixeira! O log do HijackThis está limpo. O dialer está nos temporários da Internet. O problema que relatou, é muito provável que não seja por causa de malwares. Baixe:

 

KillBox

CCleaner > instale, mas não use ainda.

 

Rode o KillBox, marque Delete on Reboot e coloque em Full Path of File to Delete:

 

C:\Documents and Settings\Admin\Definições locais\Temporary Internet Files\Content.IE5\070X6GSP\10637-69-exe[1].exe

 

Clique no botão com o X. Responda Sim à pergunta.

 

Ao reiniciar o PC, aperte F8 intermitentemente. No menu escolha: modo seguro.

 

Rode o CCleaner, clicando em Executar Cleaner. Aguarde o exame acabar.

 

Reinicie o PC em modo normal, faça um novo scan on line e poste o resultado.

[pteixeira 0]

OK. Obrigadão.

 

RESOLVIDO

[Sam Spade 2]

PROBLEMA RESOLVIDO!

 

Caso o autor necessite que o tópico seja reaberto é necessário enviar uma Mensagem Privada para um Moderador com um link para o tópico.