[Resolvido!]Computador lento

Fábio Luis · Setembro 12, 2007

Segue o log para analise

Logfile of HijackThis v1.99.1

Scan saved at 00:20:05, on 12/09/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos De Programas\Ahead\InCD\InCDsrv.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos De Programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos De Programas\Alwil Software\Avast4\ashServ.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\Arquivos De Programas\mobile PhoneTools\WatchDog.exe

C:\ARQUIV~1\iGv6\sysbrand.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos De Programas\Windows Media Player\WMPNSCFG.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos De Programas\a-squared Free\a2service.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\Arquivos De Programas\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos De Programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos De Programas\Alwil Software\Avast4\ashWebSv.exe

C:\Arquivos De Programas\MSN Messenger\usnsvc.exe

C:\Hijack This\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R3 - URLSearchHook: Multi Media Brazil Toolbar - {01353836-0088-480b-8732-b33baae9b1a7} - C:\Arquivos De Programas\Multi_Media_Brazil\tbMult.dll

O2 - BHO: Multi Media Brazil Toolbar - {01353836-0088-480b-8732-b33baae9b1a7} - C:\Arquivos De Programas\Multi_Media_Brazil\tbMult.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos De Programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos De Programas\Java\jre1.5.0_07\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: (no name) - {7EEF1E3D-FD97-4401-BCDB-5827F2D11709} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Trixie.Bho - {B0744341-96E0-4341-9ED2-8BC36CE0CCD0} - mscoree.dll (file missing)

O3 - Toolbar: (no name) - {7EEF1E3D-FD97-4401-BCDB-5827F2D11709} - (no file)

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\ARQUIV~1\eMule\Incoming\FLASHG~1.CRA\Crack\fgiebar.dll

O3 - Toolbar: Multi Media Brazil Toolbar - {01353836-0088-480b-8732-b33baae9b1a7} - C:\Arquivos De Programas\Multi_Media_Brazil\tbMult.dll

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [googletalk] C:\Arquivos De Programas\Google\Google Talk\googletalk.exe /autostart

O4 - HKLM\..\Run: [WatchDog] C:\Arquivos De Programas\mobile PhoneTools\WatchDog.exe

O4 - HKCU\..\Run: [sysBrand] "C:\ARQUIV~1\iGv6\sysbrand.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [WMPNSCFG] C:\Arquivos De Programas\Windows Media Player\WMPNSCFG.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Arquivos De Programas\Arquivos comuns\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Studio - Censura Digital 1.5.lnk = C:\Studio\Censura\StudioCensura.exe

O8 - Extra context menu item: Descarregar tudo com o FlashGet - C:\Arquivos De Programas\eMule\Incoming\FlashGet.v1.72.Multilanguage.WinALL.Cracked-CzW\Crack\jc_all.htm

O8 - Extra context menu item: Descarregar utilizando o FlashGet - C:\Arquivos De Programas\eMule\Incoming\FlashGet.v1.72.Multilanguage.WinALL.Cracked-CzW\Crack\jc_link.htm

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {20CCCFEC-D26F-4ffe-996B-388B39C8CCCA} - C:\WINDOWS\system32\mscoree.DLL

O9 - Extra 'Tools' menuitem: Tri&xie Options... - {20CCCFEC-D26F-4ffe-996B-388B39C8CCCA} - C:\WINDOWS\system32\mscoree.DLL

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Arquivos De Programas\ICQLite\ICQLite.exe

O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Arquivos De Programas\ICQLite\ICQLite.exe

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\ARQUIV~1\eMule\Incoming\FLASHG~1.CRA\Crack\flashget.exe

O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\ARQUIV~1\eMule\Incoming\FLASHG~1.CRA\Crack\flashget.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Barra do iG - {FD1672E0-AE0D-465B-B345-F7B0944A121D} - (no file)

O11 - Options group: [iNTERNATIONAL] International*

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O14 - IERESET.INF: START_PAGE_URL=http://www.uol.com.br/

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab

O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/...lscbase9602.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1189254166390

O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m...,26/mcgdmgr.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{0C18B508-C4EF-4F1C-B358-F329295C93F1}: NameServer = 200.204.0.10 200.204.0.10

O17 - HKLM\System\CS1\Services\Tcpip\..\{0C18B508-C4EF-4F1C-B358-F329295C93F1}: NameServer = 200.204.0.10 200.204.0.10

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Arquivos De Programas\a-squared Free\a2service.exe

O23 - Service: Adobe LM Service - Adobe Systems - C:\Arquivos de programas\Arquivos comuns\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos De Programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos De Programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Arquivos De Programas\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Arquivos De Programas\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: Google Updater Service (gusvc) - Google - C:\Arquivos De Programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Arquivos De Programas\Ahead\InCD\InCDsrv.exe

O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - c:\Arquivos De Programas\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)

DigRam · Setembro 12, 2007

Bom Dia Fábio Luis!

>@< Faça o download do ComboFix.

>@< Baixe-o para o Desktop!

>@< Feche todas as janelas e execute a ferramenta!

>@< Para quem possui o Avast,surgirá um alerta de malware ( Win32 D adobra-EY[Trj] ),que deverá ser ignorado.

>@< Abrirá a janela Auto Scan. Aguarde!

>@< Digite a opção para continuar < Enter >

>@< Aguarde a conclusão!

>@< Poste o relatório: C:\ComboFix.txt,na sua resposta + Log do HJT,atualizado.

Abraços!

Fábio Luis · Setembro 12, 2007

ComboFix 07-09-10.6 - "Usuario" 2007-09-12 11:56:08.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.55.1046.18.183 [GMT -3:00]

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\WINDOWS\exefld

C:\WINDOWS\system32\Update.exe

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

-------\nm

((((((((((((((((((((((( Ficheiros criados de 2007-08-12 to 2007-09-12 ))))))))))))))))))))))))))))))))

.

2007-09-12 11:55 51,200 --a------ C:\WINDOWS\NirCmd.exe

2007-09-09 12:22 271,224 --a------ C:\WINDOWS\system32\mucltui.dll

2007-09-09 12:16 <DIR> d-------- C:\Arquivos De Programas\MSXML 6.0

2007-09-09 12:16 <DIR> d-------- C:\Arquivos De Programas\Microsoft CAPICOM 2.1.0.2

2007-09-08 23:54 <DIR> d-------- C:\Arquivos De Programas\Picasa2

2007-09-08 12:49 <DIR> d-------- C:\Arquivos De Programas\BitComet

2007-09-08 09:14 <DIR> d-------- C:\Arquivos De Programas\Microsoft SQL Server

2007-09-08 09:03 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\Microsoft Help

2007-09-08 09:03 <DIR> d-------- C:\Arquivos De Programas\Microsoft Visual Studio 8

2007-09-07 20:30 <DIR> d-------- C:\DOCUME~1\Usuario\DADOSD~1\MagicEffect Photo

2007-09-04 23:58 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\Spyware Terminator

2007-09-04 23:58 <DIR> d-------- C:\Arquivos De Programas\Spyware Terminator

2007-08-27 19:44 1,700,352 --a------ C:\WINDOWS\system32\gdiplus.dll

2007-08-27 19:43 <DIR> d-------- C:\Arquivos De Programas\Setup

2007-08-26 18:45 <DIR> d-------- C:\Arquivos De Programas\MSN Messenger

2007-08-24 18:53 <DIR> d-------- C:\WINKOCHAN_REC

2007-08-23 19:54 <DIR> d-------- C:\Arquivos De Programas\Deskshare

2007-08-23 19:53 356,352 --a------ C:\WINDOWS\eSellerateEngine.dll

2007-08-21 21:37 <DIR> d-------- C:\Studio

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2007-09-11 22:54 --------- d-------- C:\Arquivos De Programas\eMule

2007-09-09 12:34 --------- d--h----- C:\Arquivos De Programas\InstallShield Installation Information

2007-09-09 12:34 --------- d-------- C:\Arquivos De Programas\Google

2007-09-09 12:18 --------- d-------- C:\Arquivos De Programas\Microsoft Works

2007-09-08 19:39 --------- d-------- C:\DOCUME~1\Usuario\DADOSD~1\LimeWire

2007-09-08 13:37 --------- d-------- C:\Arquivos De Programas\ZaraSoft

2007-09-08 09:16 --------- d-------- C:\Arquivos De Programas\Microsoft.NET

2007-09-07 20:05 --------- d-------- C:\Arquivos De Programas\Windows Media Components

2007-09-06 07:05 94416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys

2007-09-06 07:05 92848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys

2007-09-06 07:03 23152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys

2007-09-06 07:02 42912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys

2007-09-06 07:00 26624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys

2007-08-12 19:52 --------- d-------- C:\Arquivos De Programas\Opera

2007-08-11 17:08 --------- d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\WinZip

2007-08-02 23:32 --------- d-------- C:\Arquivos De Programas\UltimateZip

2007-07-31 19:39 --------- d-------- C:\Arquivos De Programas\Winamp

2007-07-31 19:37 --------- d-------- C:\Arquivos De Programas\No-IP

2007-07-31 19:37 --------- d-------- C:\Arquivos De Programas\Cerberus

2007-07-24 00:24 --------- d-------- C:\Arquivos De Programas\Windows Media Connect 2

2007-07-16 21:57 --------- d-------- C:\Arquivos De Programas\mobile PhoneTools

2007-07-14 23:45 --------- d-------- C:\Arquivos De Programas\SUPERAntiSpyware

2007-07-14 23:43 --------- d-------- C:\DOCUME~1\Usuario\DADOSD~1\Apple Computer

2007-07-14 23:43 --------- d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\Apple Computer

2007-07-14 23:43 --------- d-------- C:\Arquivos De Programas\Apple Software Update

2007-07-14 23:21 --------- d-------- C:\Arquivos De Programas\Easy CD-DA Extractor 10

2007-06-15 21:49 8 --a------ C:\DOCUME~1\ALLUSE~1\DADOSD~1\SDGLYBMPWPP.SYS

2007-06-13 10:21 1035264 --a------ C:\WINDOWS\explorer.exe

2007-05-24 23:05 511 --a------ C:\Arquivos De Programas\INSTALL.LOG

2007-03-19 20:13 6422611 --a------ C:\Arquivos De Programas\frostwire-4.13.1.6.windows.exe

2006-12-02 02:00 3534076 --a------ C:\Arquivos De Programas\eMule0.47c-Installer.exe

2004-10-01 15:00 40960 --a------ C:\Arquivos De Programas\Uninstall_CDS.exe

2004-01-12 08:45 11854 --a------ C:\Arquivos De Programas\MPLAB_LicenseAgreement.rtf

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias & legítimas por defeito não são mostradas.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{01353836-0088-480b-8732-b33baae9b1a7}]

2007-03-19 11:50 1297432 --a------ C:\Arquivos De Programas\Multi_Media_Brazil\tbMult.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]

"{01353836-0088-480B-8732-B33BAAE9B1A7}"= C:\Arquivos De Programas\Multi_Media_Brazil\tbMult.dll [2007-03-19 11:50 1297432]

[HKEY_CLASSES_ROOT\CLSID\{01353836-0088-480B-8732-B33BAAE9B1A7}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avast!"="C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 07:06]

"googletalk"="C:\Arquivos De Programas\Google\Google Talk\googletalk.exe" [2007-01-01 19:54]

"WatchDog"="C:\Arquivos De Programas\mobile PhoneTools\WatchDog.exe" [2004-07-21 12:38]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SysBrand"="C:\ARQUIV~1\iGv6\sysbrand.exe" [2004-12-08 19:23]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:45]

"PowerBar"="" []

"WMPNSCFG"="C:\Arquivos De Programas\Windows Media Player\WMPNSCFG.exe" [2006-11-02 23:32]

C:\DOCUME~1\ALLUSE~1\MENUIN~1\PROGRA~1\INICIA~1\

Adobe Gamma Loader.lnk - C:\Arquivos De Programas\Arquivos comuns\Adobe\Calibration\Adobe Gamma Loader.exe [2007-02-15 11:48:08]

Studio - Censura Digital 1.5.lnk - C:\Studio\Censura\StudioCensura.exe [2006-02-13 11:28:18]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"ForceClassicControlPanel"=1 (0x1)

"NoSMBalloonTip"=0 (0x0)

R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys

R1 Asapi;Asapi;C:\WINDOWS\system32\drivers\Asapi.sys

R2 CX23880;Conexant 23880 Video Capture;C:\WINDOWS\system32\drivers\cx88vid.sys

R2 SQLWriter;SQL Server VSS Writer;"c:\Arquivos De Programas\Microsoft SQL Server\90\Shared\sqlwriter.exe"

S3 DSDrv4;DSDrv4;\??\C:\ARQUIV~1\ENLTV\ENLTV\REMOTE~1\DSDrv4.sys

S3 SetupNTGLM7X;SetupNTGLM7X;\??\D:\NTGLM7X.sys

.

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-09-12 11:58:56

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

PowerBar = ????????????l?@?l?@?D?????6~??????????????6~l?@?l?@????? ???????????W?9~??6~??????6~K?6~x???????[?6~???????? ??????????????|x???0???????????? ot??6~??????????????????g?????M???????l?@?l?@?????Q?7~????t?@?????l?@?8?@?l?@?3??s????????????????????8?@?_??s8?@?8?@

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2007-09-12 11:59:57 - machine was rebooted

C:\ComboFix-quarantined-files.txt ... 2007-09-12 11:59

.

--- E O F ---

Logfile of HijackThis v1.99.1

Scan saved at 12:29:36, on 12/09/2007