Pikyto 0 Denunciar post Postado Julho 12, 2007 Gostaria muito de uma opinião sobre um problema de lentidão e instabilidade no meu sistema. Placa ASUS K8N, Semprom 3000, 1024 DDR 400 Kingston, Seagate 80Gb 7200, video FX5500-256. Ao dar o boot, demora uns 5 minutos até que o WinXP fique disponível e para desligar leva mais de 1.30 minutos. Uso o Avast Pro e não tenho encontrado nenhuma infecção. Vou colocar aqui o log do Hijack. Me perdoem se não postei na área apropriada. Agradeço muito pela atenção. Abs. Logfile of HijackThis v1.99.1 Scan saved at 16:50:44, on 12/7/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SOUNDMAN.EXE C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe C:\Arquivos de programas\IC\Card Reader Driver v1.9e\Disk_Monitor.exe C:\Arquivos de programas\Microsoft IntelliType Pro\itype.exe C:\Arquivos de programas\Google\Gmail Notifier\gnotify.exe C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe C:\Arquivos de programas\QuickTime\qttask.exe C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\rundll32.exe C:\Arquivos de programas\IVT Corporation\BlueSoleil\BTNtService.exe C:\Arquivos de programas\Skype\Phone\Skype.exe C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE C:\Arquivos de programas\Bonjour\mDNSResponder.exe C:\Arquivos de programas\ATnotes\ATnotes.exe C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe C:\Arquivos de programas\GizmoPlugin\GizmoPlugin.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\oodag.exe C:\Arquivos de programas\Palm\HOTSYNC.EXE C:\Arquivos de programas\Spinach AntiSpyware\AntiSpyware.exe C:\WINDOWS\system32\PSIService.exe C:\Arquivos de programas\CyberLink\Shared files\RichVideo.exe C:\Arquivos de programas\Spyware Doctor\sdhelp.exe C:\WINDOWS\System32\PAStiSvc.exe C:\WINDOWS\System32\svchost.exe C:\Arquivos de programas\UPHClean\uphclean.exe C:\WINDOWS\System32\Drivers\WTSRV.EXE C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\alg.exe C:\Arquivos de programas\Skype\Plugin Manager\SkypePM.exe C:\Arquivos de programas\MSN Messenger\usnsvc.exe C:\Arquivos de programas\Internet Explorer\iexplore.exe C:\Documents and Settings\PC\Desktop\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: Multi_Media toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Arquivos de programas\Multi_Media\tbMul0.dll O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: CompSegIB - {2E3C3651-B19C-4DD9-A979-901EC3E930AF} - C:\Arquivos de programas\Scpad\scpsssh2.dll O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\ARQUIV~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Multi_Media toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Arquivos de programas\Multi_Media\tbMul0.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\ARQUIV~1\SPYWAR~1\tools\iesdpb.dll O2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\WINDOWS\Downloaded Program Files\gbiehCef.dll O2 - BHO: G-Buster Browser Defense Unibanco - {C41A1C0E-EA6C-11D4-B1B8-444553540008} - C:\WINDOWS\Downloaded Program Files\gbiehuni.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Multi_Media toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Arquivos de programas\Multi_Media\tbMul0.dll O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Disk Monitor] C:\Arquivos de programas\IC\Card Reader Driver v1.9e\Disk_Monitor.exe O4 - HKLM\..\Run: [DVD43] "C:\Arquivos de programas\DVD Region+CSS Free\DVDRegionFree.exe" /hidden O4 - HKLM\..\Run: [itype] "C:\Arquivos de programas\Microsoft IntelliType Pro\itype.exe" O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Arquivos de programas\Google\Gmail Notifier\gnotify.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [skype] "C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [ATnotes.exe] C:\Arquivos de programas\ATnotes\ATnotes.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: Gerenciador do HotSync.lnk = C:\Arquivos de programas\Palm\HOTSYNC.EXE O4 - Startup: Spinach AntiSpyware.lnk = C:\Arquivos de programas\Spinach AntiSpyware\AntiSpyware.exe O8 - Extra context menu item: &NeoTrace It! - C:\ARQUIV~1\NEOTRA~1\NTXCON~1.HTM O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Arquivos de programas\MP3 Player Utilities 4.00\AMVConverter\grab.html O8 - Extra context menu item: Add to EverNote - res://C:\Arquivos de programas\EverNote\EverNote\enbar.dll/2000 O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Arquivos de programas\MP3 Player Utilities 4.00\MediaManager\grab.html O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\ARQUIV~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: Add to EverNote - {A5ABA0BB-F195-40d8-A5E9-0801153E6597} - C:\Arquivos de programas\EverNote\EverNote\enbar.dll O9 - Extra 'Tools' menuitem: Add to EverNote - {A5ABA0BB-F195-40d8-A5E9-0801153E6597} - C:\Arquivos de programas\EverNote\EverNote\enbar.dll O9 - Extra button: NeoTrace It! - {9885224C-1217-4c5f-83C2-00002E6CEF2B} - C:\ARQUIV~1\NEOTRA~1\NTXTOO~1.HTM (HKCU) O10 - Unknown file in Winsock LSP: c:\arquivos de programas\bonjour\mdnsnsp.dll O11 - Options group: [iNTERNATIONAL] International* O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://www.viidoo.tv/TVUAx.dll O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399003} (GbPluginObj Class) - https://imagem.caixa.gov.br/cab/GbPluginCef.cab O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399008} (GbPluginObj Class) - https://clickbanking.unibanco.com.br/GbPlug...GbPluginUni.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{47E9DC10-2D89-4BBC-BF12-4D61A7DC137E}: NameServer = 208.67.222.222,208.67.220.220 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Arquivos de programas\Arquivos comuns\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Arquivos de programas\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Arquivos de programas\Bonjour\mDNSResponder.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Gbp Service (GbpSv) - Banco Unibanco - C:\Arquivos de programas\GbPlugin\GbpSv.exe O23 - Service: Gizmo VoIP Service (Gizmo Plugin) - SIPphone, Inc. - C:\Arquivos de programas\GizmoPlugin\GizmoPlugin.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Arquivos de programas\iPod\bin\iPodService.exe O23 - Service: LEC TranslateDotNet Server - Language Engineering Corporation, LLC - C:\Arquivos de programas\Power Translator\LogoMedia TranslateDotNet Server.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Arquivos de programas\CyberLink\Shared files\RichVideo.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Arquivos de programas\Spyware Doctor\sdhelp.exe O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\System32\Drivers\WTSRV.EXE Compartilhar este post Link para o post Compartilhar em outros sites
Denis Dias 0 Denunciar post Postado Julho 13, 2007 Baixe o combofix em: http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe 1) Dê um duplo-clique no combofix.exe e tecle "Y" para prosseguir. O processo vai durar, em média, 10 minutos; 2) O ComboFix reiniciará o PC automaticamente, a fim de que o processo de remoção seja finalizado; 3) Quando a varredura acabar, será gerado um log, que estará em C:\ComboFix.txt; 4) Não clique na janela do ComboFix, nem feche clicando no X, enquanto a ferramenta estiver sendo executada, pois isto implicará na desconfiguração de seu desktop (ele ficará todo branco); 5) Para parar ou sair do ComboFix, tecle "N"; 6) Preciso que você cole o conteúdo do ComboFix.txt em sua próxima resposta Fico no aguardo! Compartilhar este post Link para o post Compartilhar em outros sites
Pikyto 0 Denunciar post Postado Julho 22, 2007 Prezado Denis, Desculpe-me não responder a mensagem, mas não recebi nenhuma notificação sobre a tua postagem. Rodei o programa recomendado, que gerou o log que estou anexando. Muito obrigado pela tua atenção. Um abraço "PC" - 2007-07-22 17:16:06 - ComboFix 07-07-17.8 - Service Pack 2 NTFS ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\PC\DADOSD~1.\addon.dat ((((((((((((((((((((((((( Files Created from 2007-06-22 to 2007-07-22 ))))))))))))))))))))))))))))))) 2007-07-22 17:14 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-22 14:40 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-07-22 14:40 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-07-21 21:37 29,704 --a------ C:\WINDOWS\system32\uxtuneup.dll 2007-07-21 21:36 <DIR> d-------- C:\DOCUME~1\PC\DADOSD~1\TuneUp Software 2007-07-21 21:36 <DIR> d-------- C:\Arquivos de programas\TuneUp Utilities 2007 2007-07-21 21:34 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\TuneUp Software 2007-07-20 14:58 22,080 --a------ C:\WINDOWS\system32\drivers\sshrmd.sys 2007-07-20 14:58 21,056 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys 2007-07-20 14:58 20,544 --a------ C:\WINDOWS\system32\drivers\SSFS0509.sys 2007-07-20 14:58 144,448 --a------ C:\WINDOWS\system32\drivers\ssidrv.sys 2007-07-20 14:58 <DIR> d-------- C:\DOCUME~1\LOCALS~1\DADOSD~1\Webroot 2007-07-20 14:58 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\Webroot 2007-07-20 14:58 <DIR> d-------- C:\Arquivos de programas\Webroot 2007-07-20 14:55 <DIR> d-------- C:\DOCUME~1\PC\DADOSD~1\Webroot 2007-07-18 17:04 <DIR> d-------- C:\Arquivos de programas\Microsoft IntelliPoint 2007-07-18 16:06 151,552 --a------ C:\WINDOWS\system32\DVZAddin.dll 2007-07-18 16:02 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\DataViz 2007-07-18 16:02 <DIR> d-------- C:\Arquivos de programas\Documents To Go 2007-07-18 16:02 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\DataViz 2007-07-12 19:04 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2007-07-12 19:04 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\Kaspersky Lab 2007-07-11 21:06 21,504 --a------ C:\WINDOWS\system32\drivers\motmodem.sys 2007-07-11 21:06 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll 2007-07-08 17:08 <DIR> d-------- C:\Arquivos de programas\Tweak-XP Pro 4 2007-07-06 11:42 <DIR> d-------- C:\WINDOWS\5158974E2D28401893357694C2974746.TMP 2007-07-05 23:09 <DIR> d-------- C:\DOCUME~1\PC\DADOSD~1\Avanquest 2007-07-05 21:45 9,175,040 --a------ C:\DOCUME~1\PC\ntuser.dat 2007-07-05 21:37 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Wise Installation Wizard 2007-07-05 21:04 <DIR> dr-hs---- C:\_Backup.RC 2007-07-05 21:03 <DIR> d-------- C:\DOCUME~1\PC\DADOSD~1\VCOM 2007-07-05 21:02 <DIR> d-------- C:\Arquivos de programas\VCOM 2007-07-05 20:11 <DIR> d-------- C:\Arquivos de programas\RAR Password Cracker 2007-07-05 19:23 <DIR> d-------- C:\Arquivos de programas\Rar Repair Tool 2007-07-05 17:44 <DIR> d-------- C:\RRT 2007-07-05 16:51 <DIR> d-------- C:\Vcom 2007-07-05 13:49 <DIR> d-------- C:\WINDOWS\system32\Firefox 2007-06-28 19:06 <DIR> d-------- C:\Arquivos de programas\ZSoft 2007-06-27 22:27 <DIR> d-------- C:\Arquivos de programas\GizmoPlugin 2007-06-26 14:57 0 --a------ C:\WINDOWS\system32\default_user_class.dat 2007-06-26 14:13 <DIR> d-------- C:\DOCUME~1\PC\DADOSD~1\Media Player Classic 2007-06-26 14:12 <DIR> d-------- C:\Arquivos de programas\XP Codec Pack 2007-06-25 17:21 <DIR> d-------- C:\Arquivos de programas\K-Lite Codec Pack 2007-06-25 11:35 9,856 --a------ C:\WINDOWS\system32\drivers\pfc.sys 2007-06-25 11:35 671,744 --a------ C:\WINDOWS\system32\DolbyHph.dll 2007-06-25 11:35 60,416 --a------ C:\WINDOWS\system32\DSETUP.dll 2007-06-25 11:35 4,608 --a------ C:\WINDOWS\system32\drivers\nvport.sys 2007-06-25 11:35 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\NVIDIA Corporation 2007-06-25 11:35 <DIR> d-------- C:\Arquivos de programas\NVIDIA Corporation (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-22 20:13:08 -------- d-----w C:\DOCUME~1\PC\DADOSD~1\Skype 2007-07-22 17:40:29 -------- d-----w C:\Arquivos de programas\Picasa2 2007-07-22 17:40:23 -------- d-----w C:\Arquivos de programas\Google 2007-07-22 11:25:22 -------- d-----w C:\Arquivos de programas\Spinach AntiSpyware 2007-07-22 01:07:56 -------- d-----w C:\DOCUME~1\PC\DADOSD~1\uTorrent 2007-07-21 00:16:35 -------- d-----w C:\DOCUME~1\PC\DADOSD~1\LimeWire 2007-07-21 00:15:00 -------- d-----w C:\Arquivos de programas\LimeWire 2007-07-19 22:34:37 -------- d-----w C:\DOCUME~1\PC\DADOSD~1\Vso 2007-07-18 21:29:30 86,910 ----a-w C:\WINDOWS\system32\perfc016.dat 2007-07-18 21:29:30 487,084 ----a-w C:\WINDOWS\system32\perfh016.dat 2007-07-18 19:06:39 -------- d-----w C:\Arquivos de programas\Palm 2007-07-18 18:26:50 -------- d-----w C:\Arquivos de programas\eMule 2007-07-12 00:07:15 -------- d-----w C:\Arquivos de programas\Motorola Phone Tools 2007-07-12 00:04:01 -------- d-----w C:\Arquivos de programas\LiveUpdate 2007-07-11 23:29:17 -------- d-----w C:\DOCUME~1\PC\DADOSD~1\Corel 2007-07-11 23:21:55 5,746 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2007-07-08 20:06:08 737,280 ----a-w C:\WINDOWS\iun6002.exe 2007-07-06 14:45:32 -------- d--h--w C:\Arquivos de programas\InstallShield Installation Information 2007-06-30 16:51:29 -------- d-----w C:\DOCUME~1\PC\DADOSD~1\Ahead 2007-06-30 16:21:38 -------- d-----w C:\Arquivos de programas\Blaze Media Pro 2007-06-26 22:34:54 -------- d-----w C:\Arquivos de programas\Joost 2007-06-26 13:49:15 -------- d-----w C:\DOCUME~1\PC\DADOSD~1\Registry Booster 2007-06-20 20:30:51 -------- d-----w C:\DOCUME~1\PC\DADOSD~1\Real 2007-06-20 20:26:25 -------- d-----w C:\Arquivos de programas\Real 2007-06-20 20:24:49 -------- d-----w C:\Arquivos de programas\Arquivos comuns\xing shared 2007-06-20 20:24:31 -------- d-----w C:\Arquivos de programas\Arquivos comuns\Real 2007-06-19 00:48:11 -------- d-----w C:\DOCUME~1\PC\DADOSD~1\Leadertech 2007-06-17 01:26:24 -------- d-----w C:\DOCUME~1\PC\DADOSD~1\Joost 2007-06-17 00:57:52 -------- d-----w C:\Arquivos de programas\Norton AntiVirus 2007-06-17 00:27:02 -------- d-----w C:\Arquivos de programas\Bonjour 2007-06-17 00:11:36 -------- d-----w C:\Arquivos de programas\Arquivos comuns\Macrovision Shared 2007-06-16 01:18:14 -------- d-----w C:\Arquivos de programas\UPHClean 2007-06-15 23:37:00 -------- d-----w C:\DOCUME~1\PC\DADOSD~1\Zeon 2007-06-14 21:18:12 -------- d-----w C:\Arquivos de programas\Multi_Media 2007-06-14 15:43:09 -------- d-----w C:\Arquivos de programas\Spyware Doctor 2007-06-14 13:51:42 -------- d-----w C:\Arquivos de programas\PortTrigger 2007-06-14 02:06:25 -------- d-----w C:\Arquivos de programas\RegCure 2007-06-13 21:06:33 -------- d-----w C:\Arquivos de programas\Yamicsoft 2007-06-12 22:41:21 664 ----a-w C:\WINDOWS\system32\d3d9caps.dat 2007-06-12 13:53:19 -------- d-----w C:\DOCUME~1\PC\DADOSD~1\Ambient Design 2007-06-12 13:49:16 -------- d-----w C:\Arquivos de programas\Ambient Design 2007-06-11 22:37:07 552 ----a-w C:\WINDOWS\system32\d3d8caps.dat 2007-06-11 20:02:43 -------- d-----w C:\Arquivos de programas\Microsoft IntelliType Pro 2007-06-07 19:10:48 20,480 ----a-w C:\WINDOWS\system32\ac3config.exe 2007-06-04 16:33:32 -------- d-----w C:\Arquivos de programas\Audacity 2007-06-01 19:33:28 -------- d-----w C:\DOCUME~1\PC\DADOSD~1\ScanSoft 2007-06-01 19:33:16 -------- d-----w C:\Arquivos de programas\Arquivos comuns\ScanSoft Shared 2007-06-01 19:32:41 -------- d-----w C:\Arquivos de programas\ScanSoft 2007-05-31 21:56:22 -------- d-----w C:\Arquivos de programas\Power Translator 2007-05-31 21:50:20 -------- d-----w C:\Arquivos de programas\Windows Media Connect 2 2007-05-31 21:49:45 -------- d-----w C:\Arquivos de programas\HPNotas 2007-05-31 14:05:36 -------- d-----w C:\DOCUME~1\PC\DADOSD~1\HPNotas 2007-05-25 14:17:17 -------- d-----w C:\Arquivos de programas\CloneDVD 2007-05-24 23:02:03 -------- d-----w C:\DOCUME~1\PC\DADOSD~1\Canon 2007-05-24 22:03:49 921,632 ----a-w C:\PA7311.DAT 2007-05-24 21:30:43 -------- d-----w C:\DOCUME~1\PC\DADOSD~1\Arcsoft 2007-05-24 21:17:25 -------- d-----w C:\Arquivos de programas\Canon 2007-05-24 21:08:24 -------- d-----w C:\Arquivos de programas\ArcSoft 2007-05-24 11:44:42 -------- d-----w C:\Arquivos de programas\QuickTime 2007-05-16 15:13:54 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-04-26 18:35:31 3,522 ----a-w C:\WINDOWS\mozver.dat 2007-04-25 14:22:27 144,896 ----a-w C:\WINDOWS\system32\schannel.dll 2007-02-08 14:28:56 81,920 ----a-w C:\DOCUME~1\PC\DADOSD~1\ezpinst.exe 2007-02-08 14:28:56 47,360 ----a-w C:\DOCUME~1\PC\DADOSD~1\pcouffin.sys 2007-01-13 11:22:30 88 --sh--r C:\WINDOWS\system32\9F1A16F276.sys ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2006-10-22 23:08 62080 --a------ C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2E3C3651-B19C-4DD9-A979-901EC3E930AF}] 2007-04-29 21:51 124416 --------- C:\Arquivos de programas\Scpad\scpsssh2.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}] 2005-05-31 01:04 853672 --a------ C:\ARQUIV~1\SPYBOT~1\SDHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB}] 2006-08-01 15:27 825528 --a------ C:\ARQUIV~1\SPYWAR~1\tools\iesdsg.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] 2007-03-14 03:43 501400 --a------ C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}] 2003-05-15 00:03 147456 --a------ C:\Arquivos de programas\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b5146c40-189a-4311-bda9-fbae3e023187}] 2007-06-14 18:18 1326104 --a------ C:\Arquivos de programas\Multi_Media\tbMul0.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B56A7D7D-6927-48C8-A975-17DF180C71AC}] 2006-08-01 15:23 850104 --a------ C:\ARQUIV~1\SPYWAR~1\tools\iesdpb.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C41A1C0E-EA6C-11D4-B1B8-444553540003}] 2007-03-07 11:09 219456 --a------ C:\WINDOWS\Downloaded Program Files\gbiehCef.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C41A1C0E-EA6C-11D4-B1B8-444553540008}] 2007-01-12 09:58 222376 --a------ C:\WINDOWS\Downloaded Program Files\gbiehuni.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2005-06-14 07:36 C:\WINDOWS\SOUNDMAN.EXE] "avast!"="C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe" [2007-01-15 14:28] "Disk Monitor"="C:\Arquivos de programas\IC\Card Reader Driver v1.9e\Disk_Monitor.exe" [2003-06-18 06:57] "DVD43"="C:\Arquivos de programas\DVD Region+CSS Free\DVDRegionFree.exe" [2004-10-22 15:18] "itype"="C:\Arquivos de programas\Microsoft IntelliType Pro\itype.exe" [2006-07-07 20:14] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Arquivos de programas\Google\Gmail Notifier\gnotify.exe" [2005-07-15 18:48] "nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe] "IntelliPoint"="c:\Arquivos de programas\Microsoft IntelliPoint\ipoint.exe" [2007-02-05 15:52] "Picasa Media Detector"="C:\Arquivos de programas\Picasa2\PicasaMediaDetector.exe" [2007-06-15 20:15] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Skype"="C:\Arquivos de programas\Skype\Phone\Skype.exe" [2007-01-12 12:57] "ATnotes.exe"="C:\Arquivos de programas\ATnotes\ATnotes.exe" [2005-01-05 15:45] "MsnMsgr"="C:\Arquivos de programas\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:54] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:45] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Spyware Doctor"="C:\Arquivos de programas\Spyware Doctor\swdoctor.exe" /Q C:\DOCUME~1\PC\MENUIN~1\PROGRA~1\INICIA~1 Gerenciador do HotSync.lnk - C:\Arquivos de programas\Palm\HOTSYNC.EXE [2003-04-22 15:46:44] Spinach AntiSpyware.lnk - C:\Arquivos de programas\Spinach AntiSpyware\AntiSpyware.exe [2006-08-27 16:48:31] C:\DOCUME~1\ALLUSE~1\MENUIN~1\PROGRA~1\INICIA~1 DataViz Inc Messenger.lnk - C:\Arquivos de programas\Arquivos comuns\DataViz\DvzIncMsgr.exe [2007-07-18 16:02:33] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoRecentDocsMenu"=1 (0x1) "NoLowDiskSpaceChecks"=1 (0x1) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{A3717295-941D-416F-9384-ED1736729F1C}"="C:\Arquivos de programas\Scpad\scpLIB.dll" [2007-04-29 19:30] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{93994DE8-8239-4655-B1D1-5F4E91300429}"="C:\ARQUIV~1\DVDREG~2\DVDShell.dll" [2004-10-09 15:18] "{E37CB5F0-51F5-4395-A808-5FA49E399008}"="C:\WINDOWS\Downloaded Program Files\gbiehuni.dll" [2007-01-12 09:58] "{E37CB5F0-51F5-4395-A808-5FA49E399003}"="C:\WINDOWS\Downloaded Program Files\gbiehCef.dll" [2007-03-07 11:09] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WebrootSpySweeperService] path= backup= [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^ColorVisionStartup.lnk] backup=C:\WINDOWS\pss\ColorVisionStartup.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^DataViz Messenger.lnk] backup=C:\WINDOWS\pss\DataViz Messenger.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^PC^Menu Iniciar^Programas^Inicializar^Gerenciador do HotSync.lnk] path=C:\Documents and Settings\PC\Menu Iniciar\Programas\Inicializar\Gerenciador do HotSync.lnk backup=C:\WINDOWS\pss\Gerenciador do HotSync.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^PC^Menu Iniciar^Programas^Inicializar^PowerReg Scheduler.exe] backup=C:\WINDOWS\pss\PowerReg Scheduler.exeStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk] C:\Arquivos de programas\Google\Google Talk\googletalk.exe /autostart [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPNotas] C:\Arquivos de programas\HPNotas\HPNotas.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] "C:\Arquivos de programas\Arquivos comuns\InstallShield\UpdateService\isuspm.exe" -startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] "C:\Arquivos de programas\Arquivos comuns\InstallShield\UpdateService\issch.exe" -start [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Arquivos de programas\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] %systemroot%\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Language] "C:\Arquivos de programas\CyberLink\PowerDVD\Language\Language.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut] "C:\Arquivos de programas\CyberLink\PowerDVD\Language\Language.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpAgent] "C:\Arquivos de programas\ScanSoft\OmniPage15.0\OpAgent.exe" /agent [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Opware15] "C:\Arquivos de programas\ScanSoft\OmniPage15.0\Opware15.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDServ] "C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\qttask] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper] "C:\Arquivos de programas\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spyware Doctor] "C:\Arquivos de programas\Spyware Doctor\swdoctor.exe" /Q [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate] "C:\Arquivos de programas\Arquivos comuns\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_01\bin\jusched.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swdoctor] "C:\Arquivos de programas\Spyware Doctor\swdoctor.exe" /Q [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VoipDiscount] "C:\Arquivos de programas\VoipDiscount.com\VoipDiscount\VoipDiscount.exe" -nosplash -minimized HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - netsvcs UxTuneUp HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{894D824D-1695-1DEC-152F-F81011D32339} C:\WINDOWS\system32\Firefox\avaagent.exe s Contents of the 'Scheduled Tasks' folder 2007-07-22 00:37:40 C:\WINDOWS\tasks\1-Click Maintenance.job 2007-07-22 20:00:02 C:\WINDOWS\tasks\RegCure Program Check.job 2007-06-14 01:56:21 C:\WINDOWS\tasks\RegCure.job 2007-07-22 19:38:24 C:\WINDOWS\tasks\User_Feed_Synchronization-{50625135-7040-413E-A80B-BBED630A7F52}.job ************************************************************************** catchme 0.3.1040 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-22 17:23:57 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System] "OODEFRAG08.00.00.01WORKSTATION"="D4C40F01A2DC79F90756EAAF7B2DE74C050C906AB5CD517C50332719A14A296B126DE5B26BF BC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFE C9E127BECC74C8EDD5E5BE2F6E6675D575E7D6A3B9808C038D530D6EB3452A2D97226D213B55595C 9FD2BAFA1C615FE65609F2F3B0FB7AE9F53167573979C7A691B8CA880A4C8EC7161514BA63BD7672 1AB303DF9B6823E030FD59B9E6FA9020B8EDB90E5DC74E41C8DA4C667F535CD81B597E510CA4316F 6E2A747BE754980A2E810C66095A82201012D32D2178046749E457D52B04407EDD5A203451189E11 288AB146038DA93E4232AFA8A8074867AF90FF380EC6251DDFE6F7151261D23AA64B737A1E77B6D4 C3265C2F72D0E753DA1ED7258BF1A96657CAA1C015F14D1AAC0B5EC4294529E683369FC2D42215CE 2A9AF29D03B41DF442AF52ADD4D9A771C16DC73216E456817E0D8AB15C01F604AEBF150935F59A84 9D6250E1B31E2E125AC78855034364D5BDDE04845C986C9531D4118C52B712194721A6617D6C1D90 0791832DCAB66BC794E1B56781A4A29DAD498D859A4E3F8DCAE5605589F963F83906706B087EDE9D 0371A3E9BF49BCDEB2C4FA92EB57DC28CC3AD3C456E2E7D26EED060466702220A240E85EA72A2F45 2AA56EC5F9A5B0901E43E97313CFA303ADB48AEDA544E4894EF05D1F69F002D5C90B5ACD14E2FEF1 9A167955518A065C90C7DF7BF6F7C702A0BE98D35553467C72C5681E8A3464105312E7ED46CD4C05 3E4996127D12FDB24BC59EAE673562280998D9FD86E00CABACDB127B11E14A55D63B1AEA92D23558 0C0F6B664DB6621D24DA37B503F0D7B2457DB49D7C80F33BE9D082B504DA64701D0789D771D415DF 0E349943AFA8F4FDCC3490A0BC7EA6F83760679712444634466FB3494315616AB91405B84F28F595 D0A0E911B747DD20726192345D74FAB9A17FE88FE2863D879D0664F2433A4CE6C4F7A478AC8CA193 B4616327C398E9905D3D75F11CA09D89A8CFCBA6AB25992179115D11B0009155C658C72091828E5A 3BD425F988E208E949E6367A62E5CF0D32894E0B2C143F91F4F0A09E5D850111FEA9A66E6E6464C4 4D8639AF70AF2C523C545175FF7912C32330DEE971A34746912CAD4EB5D9E3649FCE304E311B8B1B 7F31EDAB9E71A358B72B3D198CACF1CAC11FA5B4514C9E8AF0FD855AFCBE9433E33353672723412C 79462FA37F8F876DA56EE41F866B07BC71B01D5818709F8908B1F2CE0D4A2745D02CA17288F4CC4F 42D0CEBE4AF4A50649ED1288F879DE98233C595213B97B8955758DA2468290A5DE015B43B94794A5 B5412ABDDA84104822A0FB5D44C8F119278BF9CDC873B6446482CD8D9D75995C5551A3E652A82CC5 FB3577EE73829AE17AD6C0719825" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher] "TracesProcessed"=dword:000004da scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-22 17:26:16 C:\ComboFix-quarantined-files.txt ... 2007-07-22 17:25 --- E O F --- Compartilhar este post Link para o post Compartilhar em outros sites
Mário Monteiro 179 Denunciar post Postado Setembro 23, 2008 Tópico Arquivado Como o autor não respondeu por mais de 30 dias, o tópico foi arquivado. Caso você seja o autor do tópico e quer reabrir, envie uma mensagem privada para um moderador da área juntamente com o link para este tópico e explique o motivo da reabertura. Compartilhar este post Link para o post Compartilhar em outros sites
