[Arquivado]Computador Só Liga No Modo De Segurança

[Willen Lobato 0]

Olá pessoal, meu computador agora só está ligando no modo de segurança. Quando o coloco para iniciar no modo normal aparece na tela uma "caixa" se movimentando e com as seguintes letras "hz?". Gostaria que me ajudassem com o problema para uma possivel solução.

 

segue o log:

 

Logfile of HijackThis v1.99.1

Scan saved at 17:17:31, on 10/9/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Windows Defender\MsMpEng.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Windows Defender\MSASCui.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\Arquivos de programas\MSN Messenger\msnmsgr.exe

C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe

C:\Documents and Settings\Cliente\Meus documentos\Willen\Musica\hijackthis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uol.com.br/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0

R3 - URLSearchHook: Multi_Media_Brazil toolbar - {01353836-0088-480b-8732-b33baae9b1a7} - C:\Arquivos de programas\Multi_Media_Brazil\tbMul1.dll

O2 - BHO: Multi_Media_Brazil toolbar - {01353836-0088-480b-8732-b33baae9b1a7} - C:\Arquivos de programas\Multi_Media_Brazil\tbMul1.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\ARQUIV~1\MEGAUP~1\MEGAUP~1.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\Arquivos de programas\GbPlugin\gbieh.dll

O3 - Toolbar: Multi_Media_Brazil toolbar - {01353836-0088-480b-8732-b33baae9b1a7} - C:\Arquivos de programas\Multi_Media_Brazil\tbMul1.dll

O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\ARQUIV~1\MEGAUP~1\MEGAUP~1.DLL

O4 - HKLM\..\Run: [AVG7_CC] C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [siSUSBRG] C:\WINDOWS\SiSUSBrg.exe

O4 - HKLM\..\Run: [VTTimer] VTTimer.exe

O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [ink Monitor] C:\Arquivos de programas\EPSON\Ink Monitor\InkMonitor.exe

O4 - HKLM\..\Run: [EPSON Stylus CX3700 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACL.EXE /P26 "EPSON Stylus CX3700 Series" /O6 "USB001" /M "Stylus CX3700"

O4 - HKLM\..\Run: [DataLayer] C:\Arquivos de programas\Arquivos comuns\PCSuite\DataLayer\DataLayer.exe

O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Arquivos de programas\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray

O4 - HKLM\..\Run: [Windows Defender] "C:\Arquivos de programas\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_01\bin\jusched.exe"

O4 - HKLM\..\Run: [TkBellExe] "C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [PcSync] C:\Arquivos de programas\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

O4 - HKCU\..\Run: [updateMgr] C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9

O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Arquivos de programas\Arquivos comuns\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} (GbpDistObj Class) - https://www14.bancobrasil.com.br/plugin/GbpDist.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe

O23 - Service: Gbp Service (GbpSv) - Unknown owner - C:\Arquivos de programas\GbPlugin\GbpSv.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

O23 - Service: Creative VF0090 RunApp Service (VF0090Srv) - Creative Technology Ltd. - C:\WINDOWS\system32\V0090Srv.exe

 

Fico no aguardo. :joia:

 

Willen

[jgarcia 1]

Opa Willen Lobato,

 

Baixe o ComboFix em:

ComboFix

 

1) Dê um duplo-clique no combofix.exe e tecle "Y" para prosseguir. O processo vai durar, em média, 10 minutos;

2) O ComboFix reiniciará o PC automaticamente, a fim de que o processo de remoção seja finalizado (somente se houver infecção);

3) Quando a varredura acabar, será gerado um log, que estará em C:\ComboFix.txt;

4) Não clique na janela do ComboFix, nem feche clicando no X, enquanto a ferramenta estiver sendo executada, pois isto implicará na desconfiguração de seu desktop (ele ficará todo branco);

5) Para parar ou sair do ComboFix, tecle "N";

6) Preciso que você cole o conteúdo do ComboFix.txt em sua próxima resposta.

 

Abraços.

[Willen Lobato 0]

Opa amigo...desculpe a demora...

 

Fiz o que você pediu e foi gerado o log que segue abaixo.

 

Obrigado e estou no aguardo para novas informações.

-------------------------------------------------------------------------------------------------------------------------------------------------

 

ComboFix 07-09-17.2 - "Cliente" 2007-09-17 13:24:09.1 - NTFSx86 NETWORK

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.793 [GMT -3:00]

.

 

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\Arquivos de programas\gbplugin\Bb.gpc

C:\Arquivos de programas\gbplugin\Bb.gpc . . . . failed to delete

C:\Arquivos de programas\gbplugin\gbieh.gmd

 

.

((((((((((((((((((((((((( Files Created from 2007-08-17 to 2007-09-17 )))))))))))))))))))))))))))))))

.

 

2007-09-17 13:22 51,200 --a------ C:\WINDOWS\NirCmd.exe

2007-09-13 22:57 <DIR> d-------- C:\WINDOWS\SxsCaPendDel

2007-09-10 18:13 552 --a------ C:\WINDOWS\system32\d3d8caps.dat

2007-09-10 14:42 <DIR> d-------- C:\WINDOWS\system32\ActiveScan

2007-08-31 16:13 <DIR> d-------- C:\Arquivos de programas\ArtMoney

2007-08-30 11:18 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\WildTangent

2007-08-29 13:04 <DIR> d-------- C:\Arquivos de programas\Take2

2007-08-28 11:10 <DIR> d-------- C:\WINDOWS\United Football

2007-08-28 11:10 <DIR> d-------- C:\Arquivos de programas\United Football

2007-08-23 19:06 1,106,566 --a------ C:\instalar.execvccc.exe

2007-08-22 19:38 <DIR> d-------- C:\MySlideshow

2007-08-22 19:03 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\DADOSD~1\TEMP

2007-08-22 19:03 <DIR> d-------- C:\Arquivos de programas\DVD Photo Slideshow Professional

2007-08-20 13:17 <DIR> d-------- C:\Arquivos de programas\Riva

2007-08-20 13:17 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\SWF Studio

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2007-09-17 13:26 --------- d-------- C:\Arquivos de programas\GbPlugin

2007-09-13 22:57 --------- d-------- C:\Arquivos de programas\MSN Messenger

2007-09-12 22:01 --------- d-------- C:\Arquivos de programas\All Cleaner

2007-09-10 15:32 --------- d-------- C:\Arquivos de programas\Windows Defender

2007-09-10 15:26 --------- d-------- C:\Arquivos de programas\Messenger Plus! Live

2007-09-02 15:24 --------- d-------- C:\Arquivos de programas\eMule

2007-08-28 10:38 --------- d-------- C:\Arquivos de programas\EA GAMES

2007-08-14 18:24 --------- d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\GbPlugin

2007-08-09 08:56 --------- d--h----- C:\Arquivos de programas\InstallShield Installation Information

2007-08-08 20:28 --------- d-------- C:\Arquivos de programas\Marcos Velasco Security

2007-07-27 21:37 --------- d-------- C:\Arquivos de programas\Windows Live Safety Center

2007-07-27 16:57 --------- d-------- C:\Arquivos de programas\Player Tool

2007-07-19 18:24 --------- d-------- C:\Arquivos de programas\GameVicio

2007-07-19 17:47 --------- d-------- C:\Arquivos de programas\Rockstar Games

2007-06-22 18:34 316928 --a------ C:\cante.exe

2007-05-23 22:56 592 --a--c--- C:\Arquivos de programas\INSTALL.LOG

2007-03-19 20:13 6422611 --a--c--- C:\Arquivos de programas\frostwire-4.13.1.6.windows.exe

.

 

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

 

*Note* empty entries & legit default entries are not shown

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{01353836-0088-480b-8732-b33baae9b1a7}]

2007-05-29 21:16 1326104 --a------ C:\Arquivos de programas\Multi_Media_Brazil\tbMul1.dll

 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]

"{01353836-0088-480B-8732-B33BAAE9B1A7}"= C:\Arquivos de programas\Multi_Media_Brazil\tbMul1.dll [2007-05-29 21:16 1326104]

 

[HKEY_CLASSES_ROOT\CLSID\{01353836-0088-480B-8732-B33BAAE9B1A7}]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AVG7_CC"="C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe" [2007-08-16 10:40]

"SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 07:15]

"VTTimer"="VTTimer.exe" [2003-08-20 00:56 C:\WINDOWS\system32\VTTimer.exe]

"PCTVOICE"="pctspk.exe" [2003-07-17 16:01 C:\WINDOWS\system32\pctspk.exe]

"SoundMan"="SOUNDMAN.EXE" [2004-09-16 09:39 C:\WINDOWS\soundman.exe]

"NeroFilterCheck"="C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-03-09 15:29]

"nwiz"="nwiz.exe" [2006-03-09 15:29 C:\WINDOWS\system32\nwiz.exe]

"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-03-09 15:29]

"Ink Monitor"="C:\Arquivos de programas\EPSON\Ink Monitor\InkMonitor.exe" [2004-05-05 11:54]

"EPSON Stylus CX3700 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACL.exe" [2005-02-07 08:00]

"DataLayer"="C:\Arquivos de programas\Arquivos comuns\PCSuite\DataLayer\DataLayer.exe" [2005-06-07 11:31]

"PCSuiteTrayApplication"="C:\Arquivos de programas\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2005-06-29 15:29]

"Windows Defender"="C:\Arquivos de programas\Windows Defender\MSASCui.exe" [2006-11-03 18:20]

"SunJavaUpdateSched"="C:\Arquivos de programas\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]

"TkBellExe"="C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" [2007-05-31 12:20]

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MsnMsgr"="C:\Arquivos de programas\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 13:32]

"PcSync"="C:\Arquivos de programas\Nokia\Nokia PC Suite 6\PcSync2.exe" [2005-06-24 14:08]

"updateMgr"="C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45]

"MSMSGS"="C:\Arquivos de programas\Messenger\msmsgs.exe" [2004-10-13 13:24]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:45]

 

C:\DOCUME~1\ALLUSE~1\MENUIN~1\PROGRA~1\INICIA~1\

Adobe Gamma Loader.lnk - C:\Arquivos de programas\Arquivos comuns\Adobe\Calibration\Adobe Gamma Loader.exe [2007-08-09 08:58:40]

Adobe Reader Speed Launch.lnk - C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]

Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2005-11-01 10:13:32]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{E37CB5F0-51F5-4395-A808-5FA49E399F83}"= C:\Arquivos de programas\GbPlugin\gbieh.dll [2007-06-25 09:24 332616]

 

R0 SiSRaid;SiSRaid;C:\WINDOWS\system32\DRIVERS\SiSRaid.sys

R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys

R2 GbpSv;Gbp Service;C:\Arquivos de programas\GbPlugin\GbpSv.exe

R3 V0090VID;Creative WebCam Vista Plus;C:\WINDOWS\system32\DRIVERS\V0090Vid.sys

S3 usb2vcom;USB to Serial Bridge Controller;C:\WINDOWS\system32\DRIVERS\usb2vcom.sys

S3 VF0090Srv;Creative VF0090 RunApp Service;C:\WINDOWS\system32\V0090Srv.exe

 

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3c84e798-e78b-11db-b3d5-0011d8f85643}]

AutoRun\command- \USBToolBox\ToolBox.exe

 

.

Contents of the 'Scheduled Tasks' folder

"2007-09-17 16:26:56 C:\WINDOWS\Tasks\MP Scheduled Scan.job"

- C:\Arquivos de programas\Windows Defender\MpCmdRun.exe

.

**************************************************************************

 

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-09-17 13:27:35

Windows 5.1.2600 Service Pack 2 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

.

Completion time: 2007-09-17 13:29:36 - machine was rebooted

C:\ComboFix-quarantined-files.txt ... 2007-09-17 13:29

.

--- E O F ---

[jgarcia 1]

Opa Willen Lobato,

 

Submeta os arquivos abaixo, um de cada vez, ao site da Jotti:

 

C:\instalar.execvccc.exe

C:\Arquivos de programas\INSTALL.LOG

C:\Arquivos de programas\frostwire-4.13.1.6.windows.exe

 

... e retorne com os resultados.

 

Abraços.

[Sam Spade 2]

Tópico Arquivado

 

Como o autor não respondeu por mais de 20 dias, o tópico foi arquivado.

 

Caso você seja o autor do tópico e quer reabrir, envie uma mensagem privada para um moderador da área juntamente com o link para este tópico e explique o motivo da reabertura.