Pc novo, mas ja esta reiniciando sozinho e fecha o i.e e msn.

[Educta2008 0]

Ola, sou novo neste forum e conto com a ajuda dos participantes.

 

Eis o meu log, alguem da um olhada por favor:

_______________________________________

Logfile of HijackThis v1.99.1

Scan saved at 10:08:52, on 2/8/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0011)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\savedump.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Arquivos de programas\Analog Devices\Core\smax4pnp.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe

C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe

C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe

C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe

C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe

C:\ARQUIV~1\Grisoft\AVG7\avgemc.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\Administrador\Desktop\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [soundMAXPnP] C:\Arquivos de programas\Analog Devices\Core\smax4pnp.exe

O4 - HKLM\..\Run: [soundMAX] "C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe" /tray

O4 - HKLM\..\Run: [RemoteControl] "C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [LanguageShortcut] "C:\Arquivos de programas\CyberLink\PowerDVD\Language\Language.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [AVG7_CC] C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~1\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~1\OFFICE11\REFIEBAR.DLL

O11 - Options group: [iNTERNATIONAL] International*

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O14 - IERESET.INF: START_PAGE_URL=http://www.compartilhando.org/

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by107fd.bay107.hotmail.msn.com/resources/MsnPUpld.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgemc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

 

--------------------------------------------------------------

Obrigado, agradeço pela atenção.

[Educta2008 0]

Poxa galera. Acho q meu jeito vai ser formatar.O AVG nao abre maisO Msn trava a maquinaO Combofix da erro, ou nem abre as vezes. quando abre nao consegue concluir o scan. msgs aparecem na tela para depurar ou fechar.ta feia a coisa.

[Educta2008 0]

Desta vez consigui gerar o log do combofix, apesar de ter aparecido msgs de erro durante o processo:

Ai esta o log:

 

ComboFix 07-07-30.2 - "Administrador" 2007-08-02 13:24:02.3 [GMT -3:00] - NTFS [sAFE MODE]

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.Verdadeiro

 

 

((((((((((((((((((((((((( Files Created from 2007-07-02 to 2007-08-02 )))))))))))))))))))))))))))))))

 

 

2007-08-02 13:22 <DIR> d-------- C:\VundoFix Backups

2007-08-02 13:11 <DIR> d-------- C:\!KillBox

2007-08-02 13:10 <DIR> d--hs---- C:\WINDOWS\CSC

2007-08-02 12:59 51,200 --a------ C:\WINDOWS\nircmd.exe

2007-08-02 10:52 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\Spybot - Search & Destroy

2007-08-01 19:15 <DIR> d-------- C:\DOCUME~1\ADMINI~1\DADOSD~1\Google

2007-08-01 19:12 <DIR> d-------- C:\Arquivos de programas\Google

2007-08-01 14:27 <DIR> d-------- C:\LOOXIS

2007-08-01 14:24 <DIR> d-------- C:\DOCUME~1\ADMINI~1\DADOSD~1\WinRAR

2007-08-01 09:48 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll

2007-08-01 09:48 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll

2007-08-01 09:48 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll

2007-08-01 09:48 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll

2007-08-01 09:48 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll

2007-08-01 09:48 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll

2007-08-01 09:48 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll

2007-08-01 09:48 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll

2007-08-01 09:06 936 --a------ C:\logMX500.dat

2007-08-01 08:54 89,360 --a------ C:\WINDOWS\system32\vb5db.dll

2007-08-01 08:54 77,824 --a------ C:\WINDOWS\system32\msbind.dll

2007-08-01 08:54 135,168 --a------ C:\WINDOWS\system32\wab.dll

2007-08-01 08:54 <DIR> d-------- C:\Arquivos de programas\LG Link

2007-08-01 08:53 41,664 --a------ C:\WINDOWS\system32\drivers\lgusbmodem.sys

2007-08-01 08:53 39,136 --a------ C:\WINDOWS\system32\drivers\lgUsbDiag.sys

2007-08-01 08:53 20,092 --a------ C:\WINDOWS\system32\drivers\lgusbbus.sys

2007-08-01 08:53 <DIR> d-------- C:\Arquivos de programas\LG Electronics

2007-08-01 08:42 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\NVIDIA

2007-08-01 08:40 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Contacts

2007-07-24 22:01 68,888 --a------ C:\WINDOWS\system32\xinput1_3.dll

2007-07-24 22:01 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll

2007-07-24 22:01 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll

2007-07-24 22:01 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll

2007-07-24 22:01 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll

2007-07-24 22:01 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll

2007-07-24 22:01 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll

2007-07-24 22:01 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll

2007-07-24 22:01 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll

2007-07-24 22:01 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll

2007-07-24 21:27 5,504 --------- C:\WINDOWS\system32\drivers\imagedrv.sys

2007-07-24 21:27 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll

2007-07-24 21:27 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll

2007-07-24 21:27 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll

2007-07-24 21:27 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe

2007-07-24 21:27 125,184 --------- C:\WINDOWS\system32\drivers\imagesrv.sys

2007-07-24 21:27 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll

2007-07-24 21:27 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll

2007-07-24 21:27 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Ahead

2007-07-24 21:27 <DIR> d-------- C:\Arquivos de programas\Ahead

2007-07-24 21:25 <DIR> d-------- C:\Arquivos de programas\eMule

2007-07-24 21:21 <DIR> d-------- C:\Arquivos de programas\Windows Media Connect 2

2007-07-24 21:20 <DIR> d-------- C:\WINDOWS\system32\LogFiles

2007-07-24 21:20 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF

2007-07-24 21:18 <DIR> d-------- C:\WINDOWS\system32\pt-br

2007-07-24 21:18 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\Windows Genuine Advantage

2007-07-24 21:17 592 --a------ C:\WINDOWS\chgkey.vbs

2007-07-24 21:13 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\CyberLink

2007-07-24 21:12 499,712 --------- C:\WINDOWS\system32\msvcp71.dll

2007-07-24 21:12 348,160 --------- C:\WINDOWS\system32\msvcr71.dll

2007-07-24 21:12 24,064 --------- C:\WINDOWS\system32\msxml3a.dll

2007-07-24 21:12 <DIR> d-------- C:\Arquivos de programas\CyberLink

2007-07-24 21:11 24,816 --a------ C:\WINDOWS\system32\mdimon.dll

2007-07-24 21:09 <DIR> d-------- C:\Arquivos de programas\Microsoft Works

2007-07-24 21:08 <DIR> d-------- C:\WINDOWS\SHELLNEW

2007-07-24 21:08 <DIR> d-------- C:\Arquivos de programas\Microsoft.NET

2007-07-24 21:07 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\DVD Shrink

2007-07-24 21:07 <DIR> d-------- C:\Arquivos de programas\DVD Shrink

2007-07-24 21:06 <DIR> d-------- C:\Arquivos de programas\MSN Messenger

2007-07-24 01:51 <DIR> d--hs---- C:\RECYCLER

2007-07-24 01:45 89,344 -ra------ C:\WINDOWS\system32\drivers\nvraid.sys

2007-07-24 01:45 19,456 -ra------ C:\WINDOWS\system32\nvraidco.dll

2007-07-24 01:45 19,456 --a------ C:\WINDOWS\system32\nvraiins.dll

2007-07-24 01:45 105,088 -ra------ C:\WINDOWS\system32\drivers\nvatabus.sys

2007-07-24 01:36 53,248 --------- C:\WINDOWS\system32\wdmioctl.dll

2007-07-24 01:36 49,152 --a------ C:\WINDOWS\system32\DSndUp.exe

2007-07-24 01:36 45,056 --------- C:\WINDOWS\system32\CleanUp.exe

2007-07-24 01:36 1,285,632 --------- C:\WINDOWS\system32\SMMedia.dll

2007-07-24 01:36 <DIR> d--h----- C:\Arquivos de programas\InstallShield Installation Information

2007-07-24 01:28 16,128 --a------ C:\WINDOWS\system32\drivers\MODEMCSA.sys

2007-07-24 01:15 618,089 --a------ C:\WINDOWS\system32\drivers\IntelC52.sys

2007-07-24 01:15 51,333 --a------ C:\WINDOWS\system32\drivers\IntelC53.sys

2007-07-24 01:15 51,029 --a------ C:\WINDOWS\system32\IntelCci.dll

2007-07-24 01:15 31,440 --a------ C:\WINDOWS\system32\drivers\mohfilt.sys

2007-07-24 01:15 163,840 --a------ C:\WINDOWS\system32\intelmoh.dll

2007-07-24 01:15 1,086,677 --a------ C:\WINDOWS\system32\drivers\IntelC51.sys

2007-07-24 01:05 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe

2007-07-24 01:05 <DIR> d-------- C:\WINDOWS\nview

2007-07-24 01:04 <DIR> d-------- C:\NVIDIA

2007-07-24 00:59 82,944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys

2007-07-24 00:59 7,552 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys

2007-07-24 00:59 60,800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys

2007-07-24 00:59 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys

2007-07-24 00:59 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys

2007-07-24 00:59 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys

2007-07-24 00:59 5,376 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys

2007-07-24 00:59 4,992 --a------ C:\WINDOWS\system32\drivers\MSPQM.sys

2007-07-24 00:59 2,944 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys

2007-07-24 00:59 171,776 --a------ C:\WINDOWS\system32\drivers\kmixer.sys

2007-07-24 00:59 142,464 --a------ C:\WINDOWS\system32\drivers\aec.sys

2007-07-24 00:58 93,824 -ra------ C:\WINDOWS\system32\drivers\aeaudio.sys

2007-07-24 00:58 765,952 -ra------ C:\WINDOWS\system\crlds3d.dll

 

 

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

 

2007-07-24 21:22 68578 --a------ C:\WINDOWS\system32\perfc016.dat

2007-07-24 21:22 427700 --a------ C:\WINDOWS\system32\perfh016.dat

--------- C:\Arquivos de programas\Serviços on-line

--------- C:\Arquivos de programas\Arquivos comuns\Serviços

 

 

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

 

 

*Note* empty entries & legit default entries are not shown

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"nwiz"="nwiz.exe" [2007-04-19 13:26 C:\WINDOWS\system32\nwiz.exe]

"SoundMAXPnP"="C:\Arquivos de programas\Analog Devices\Core\smax4pnp.exe" [2006-04-30 23:07]

"SoundMAX"="C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe" [2006-04-10 09:19]

"RemoteControl"="C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe" [2006-12-06 18:37]

"LanguageShortcut"="C:\Arquivos de programas\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 22:55]

"AVG7_CC"="C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe" [2007-07-24 21:30]

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:45]

"MsnMsgr"="C:\Arquivos de programas\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]

 

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]

"MsnMsgr"="C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background

 

C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\

Adobe Reader Speed Launch.lnk - C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"ForceClassicControlPanel"=1 (0x1)

 

R3 MTsensor;ATK0110 ACPI UTILITY;C:\WINDOWS\system32\DRIVERS\ASACPI.sys

S1 AmdK8;AMD Processor Driver;C:\WINDOWS\system32\DRIVERS\AmdK8.sys

S2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};\??\C:\Arquivos de programas\CyberLink\PowerDVD0.fcl

S3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service;C:\WINDOWS\system32\drivers\ADIHdAud.sys

S3 IntelC51;IntelC51;C:\WINDOWS\system32\DRIVERS\IntelC51.sys

S3 IntelC52;IntelC52;C:\WINDOWS\system32\DRIVERS\IntelC52.sys

S3 IntelC53;IntelC53;C:\WINDOWS\system32\DRIVERS\IntelC53.sys

S3 mohfilt;mohfilt;C:\WINDOWS\system32\DRIVERS\mohfilt.sys

S3 SenFiltService;SenFilt Service;C:\WINDOWS\system32\drivers\Senfilt.sys

S3 usbbus;LGE CDMA Composite USB Device;C:\WINDOWS\system32\DRIVERS\lgusbbus.sys

S3 UsbDiag;LGE CDMA USB Serial Port;C:\WINDOWS\system32\DRIVERS\lgUsbDiag.sys

S3 USBModem;LGE CDMA USB Modem;C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys

 

 

**************************************************************************

 

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-08-02 13:24:40

Windows 5.1.2600 Service Pack 2 NTFS

 

scanning hidden processes ...

 

scanning hidden registry entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

 

Completion time: 2007-08-02 13:24:55

C:\ComboFix2.txt ... 2007-08-02 13:01

C:\ComboFix3.txt ... 2007-08-02 13:00

 

--- E O F ---

Por favor, se alguem puder dar uma força, sou grato.

[Mário Monteiro 179]

Tópico Arquivado

 

Como o autor não respondeu por mais de 30 dias, o tópico foi arquivado.

 

Caso você seja o autor do tópico e quer reabrir, envie uma mensagem privada para um moderador da área juntamente com o link para este tópico e explique o motivo da reabertura.

[Mário Monteiro 179]

Tópico Arquivado

 

Como o autor não respondeu por mais de 30 dias, o tópico foi arquivado.

 

Caso você seja o autor do tópico e quer reabrir, envie uma mensagem privada para um moderador da área juntamente com o link para este tópico e explique o motivo da reabertura.