[Resolvido!]Clique fantasma - As janelas desativam sozinhas

bochechabk · Outubro 13, 2007

Olá,

É minha primeira vez aqui no fórum, espero que eu tenha criado o tópico da maneira correta.

Já tentei tudo aqui mas não consegui resolver, talvez seja algo super simples, mas não to conseguindo. O problema é que toda vez que eu ligo o PC as janelas abertas ficam instáveis. Por exemplo: se eu to escrevendo um email na janela do yahoo, ou mesmo um documento no word, toda hora o cursor some e o teclado não digita. Aí eu tenho que clicar na tela para continuar digitando. É como se eu mesmo tivesse dado um clique na área de trabalho ou em qqer outro lugar fora da janela.

Às vezes, quando isso acontece, aparece até uma ampulheta junto com o mouse, como se tivesse algum processo em andamento, mas sem ter nada visível. O mais estranho é que depois de uma meia hora assim pára de acontecer.

O PC tem ficado um pouco lento, e tem dado uns "slows" de vez em quando tb. Os problemas que tive recentemente foram com um vírus que ataca o processo Isass.exe. Mas o avast "aparentemente" removeu. Além disso (não sei se tem a ver), apareceu uma pasta desconhecida na pasta arquivos de programas. O nome é "Bonjour". Por último tem dois processos estranhos ocorrendo: "ctfmon.exe", que tenta executar toda vez que eu abro o internet explorer, além do que se registra no "startup entry" (pus o spybot para bloquear essa adição de entrada); "NvCplDaemon.dll", que fica entrando toda hora que o PC inicia, o spybot tb bloqueia.

Essas são as estranhisses que estão acontecendo e algumas coisas que eu fiz mas não sei se fiz certo. Vou postar o LOG do Hijackthis logo abaixo. Espero não ter escrito demais, mas foi pra tentar deixar bem claro tudo que está ocorrendo.

Obrigado pela atenção

Pentium D 2.8 GHz / 1 GB RAM/ 160 GB HD / Nividia PCI express 256k

Avast / windows defender / spybot com residente / spywareblaster / advanced windows care / CCleaner

:!:

Logfile of HijackThis v1.99.1

Scan saved at 17:16:48, on 13/10/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Bonjour\mDNSResponder.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\Arquivos de programas\CyberLink\Shared files\RichVideo.exe

c:\Recycler\svchost.exe

C:\WINDOWS\RTHDCPL.EXE

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\Arquivos de programas\Windows Defender\MSASCui.exe

C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\MSN Messenger\usnsvc.exe

C:\Arquivos de programas\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R3 - URLSearchHook: Yahoo! Barra de Ferramentas - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Arquivos de programas\FlashGet\jccatch.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\ARQUIV~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [Windows Defender] "C:\Arquivos de programas\Windows Defender\MSASCui.exe" -hide

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

O8 - Extra context menu item: &Descarregar tudo com o FlashGet - C:\Arquivos de programas\FlashGet\jc_all.htm

O8 - Extra context menu item: &Descarregar utilizando o FlashGet - C:\Arquivos de programas\FlashGet\jc_link.htm

O8 - Extra context menu item: Append to existing PDF - res://C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Arquivos de programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Sothink SWF Catcher - C:\Arquivos de programas\Arquivos comuns\SourceTec\SWF Catcher\InternetExplorer.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MIC273~1\Office12\REFIEBAR.DLL

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Arquivos de programas\FlashGet\FlashGet.exe

O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Arquivos de programas\FlashGet\FlashGet.exe

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Arquivos de programas\Arquivos comuns\SourceTec\SWF Catcher\InternetExplorer.htm

O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Arquivos de programas\Arquivos comuns\SourceTec\SWF Catcher\InternetExplorer.htm

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\arquivos de programas\bonjour\mdnsnsp.dll

O11 - Options group: [iNTERNATIONAL] International*

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O15 - Trusted Zone: http://www.ufv.br

O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1188008486390

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/vers...vex-2.2.1.6.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\ARQUIV~1\MICROS~2\Office12\GR99D3~1.DLL

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\ARQUIV~1\ARQUIV~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Arquivos de programas\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Arquivos de programas\Arquivos comuns\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Arquivos de programas\CyberLink\Shared files\RichVideo.exe

O23 - Service: Windowhelp - Unknown owner - c:\Recycler\svchost.exe

DigRam · Outubro 14, 2007

Boa Tarde bochechabk!

>@< Faça o download do ComboFix.

>@< Baixe-o para o Desktop!

>@< Feche todas as janelas e execute a ferramenta!

>@< Para quem possui o Avast,surgirá um alerta de malware ( Win32 D adobra-EY[Trj] ),que deverá ser ignorado.

>@< Abrirá a janela Auto Scan. Aguarde!

>@< Digite a opção para continuar < Enter >

>@< Aguarde a conclusão!

>@< Poste o relatório: C:\ComboFix.txt,na sua resposta + Log do HJT,atualizado.

Abraços!

bochechabk · Outubro 14, 2007

Olá DigRam,

Muito Obrigado por estar me ajudando. Aí vão os logs:

ComboFix 07-10-12.4 - Usuario 2007-10-14 19:25:55.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.534 [GMT -3:00]

Executando de: C:\Documents and Settings\Usuario\Desktop\ComboFix.exe

* Criado um novo ponto de restauro

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\RECYCLER\svchost.exe

C:\WINDOWS\2.exe

.

((((((((((((((((((((((( Ficheiros criados de 2007-09-14 to 2007-10-14 ))))))))))))))))))))))))))))))))

.

2007-10-14 19:24 51,200 --a------ C:\WINDOWS\NirCmd.exe

2007-10-12 14:18 28,672 --a------ C:\WINDOWS\system32\drivers\CO_Mon.sys

2007-10-10 13:50 <DIR> d-------- C:\WINDOWS\system32\NtmsData

2007-10-09 17:29 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll

2007-10-09 10:48 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Skype

2007-10-06 19:57 <DIR> d-------- C:\Documents and Settings\Usuario\Dados de aplicativos\Thinstall

2007-10-04 10:57 <DIR> d-------- C:\Arquivos de programas\MediaCoder

2007-09-29 14:10 0 --a------ C:\WINDOWS\nsreg.dat

2007-09-22 13:39 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy

2007-09-22 00:30 <DIR> d-------- C:\Arquivos de programas\Apple Software Update

2007-09-22 00:29 <DIR> d-------- C:\Arquivos de programas\Ahead

2007-09-22 00:29 <DIR> d-------- C:\Arquivos de programas\3ivx

2007-09-21 23:27 <DIR> d-------- C:\Downloads

2007-09-17 12:49 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Apple

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2007-10-14 22:23 --------- d-----w C:\Arquivos de programas\FlashGet

2007-10-14 21:50 --------- d-----w C:\Documents and Settings\Usuario\Dados de aplicativos\Skype

2007-10-09 20:41 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft Help

2007-10-09 13:48 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Skype

2007-10-09 13:48 --------- d-----w C:\Arquivos de programas\Skype

2007-10-08 01:58 --------- d-----w C:\Documents and Settings\Usuario\Dados de aplicativos\LimeWire

2007-10-07 21:49 3,350 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys

2007-10-04 12:56 --------- d-----w C:\Arquivos de programas\MSECACHE

2007-10-03 03:22 --------- d-----w C:\Arquivos de programas\Google

2007-10-01 15:15 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\DVD Shrink

2007-09-27 20:08 --------- d-----w C:\Arquivos de programas\QuickTime

2007-09-26 22:34 --------- d-----w C:\Documents and Settings\Usuario\Dados de aplicativos\Feedreader

2007-09-26 22:33 --------- d-----w C:\Arquivos de programas\FeedReader30

2007-09-22 14:38 --------- d-----w C:\Documents and Settings\Usuario\Dados de aplicativos\Download Manager

2007-09-22 02:28 --------- d-----w C:\Arquivos de programas\MSN Messenger

2007-09-21 04:00 --------- d-----w C:\Arquivos de programas\SpywareBlaster

2007-09-21 03:55 --------- d-----w C:\Arquivos de programas\Joost

2007-09-21 03:53 --------- d-----w C:\Arquivos de programas\Emule

2007-09-13 23:27 --------- d--h--w C:\Arquivos de programas\InstallShield Installation Information

2007-09-13 15:59 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Adobe

2007-09-07 17:23 --------- d-----w C:\Documents and Settings\Usuario\Dados de aplicativos\Apple Computer

2007-09-06 10:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe

2007-09-06 10:05 94,416 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys

2007-09-06 10:05 92,848 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys

2007-09-06 10:03 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys

2007-09-06 10:02 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys

2007-09-06 10:00 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr

2007-09-06 10:00 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys

2007-09-05 03:03 1,114 ----a-w C:\Documents and Settings\Usuario\Dados de aplicativos\filterclsid.dat

2007-09-04 02:38 --------- d-----w C:\Documents and Settings\Usuario\Dados de aplicativos\Samsung

2007-09-04 02:14 --------- d-----w C:\Arquivos de programas\Samsung

2007-08-31 19:41 --------- d-----w C:\Arquivos de programas\Windows Installer Clean Up

2007-08-31 14:28 --------- d-----w C:\Arquivos de programas\Microsoft Works

2007-08-31 14:23 --------- d-----w C:\Arquivos de programas\Microsoft Visual Studio 8

2007-08-31 13:52 --------- d-----w C:\Arquivos de programas\Microsoft.NET

2007-08-31 13:48 --------- d-----w C:\Arquivos de programas\Microsoft Small Business

2007-08-31 13:47 --------- d-----w C:\Arquivos de programas\Windows Live Safety Center

2007-08-31 13:47 --------- d-----w C:\Arquivos de programas\RegCleaner

2007-08-31 13:38 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Yahoo! Companion

2007-08-31 13:38 --------- d-----w C:\Arquivos de programas\Yahoo!

2007-08-31 13:38 --------- d-----w C:\Arquivos de programas\Windows Defender

2007-08-31 13:37 --------- d-----w C:\Arquivos de programas\Windows Media Connect 2

2007-08-31 13:35 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Nero

2007-08-31 13:35 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\CyberLink

2007-08-31 13:35 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Ahead

2007-08-31 13:34 --------- d-----w C:\Arquivos de programas\Windows Defender(3)

2007-08-31 13:34 --------- d-----w C:\Arquivos de programas\PowerISO

2007-08-31 13:34 --------- d-----w C:\Arquivos de programas\CyberLink

2007-08-30 20:32 --------- d-----w C:\Arquivos de programas\IObit

2007-08-30 01:36 --------- d-----w C:\Arquivos de programas\Microsoft Windows OneCare Live

2007-08-28 07:56 --------- d-----w C:\Arquivos de programas\Microsoft SQL Server

2007-08-28 03:11 --------- d-----w C:\Arquivos de programas\MSXML 6.0

2007-08-25 23:41 --------- d-----w C:\Arquivos de programas\Microsoft Expression

2007-08-25 23:09 --------- d-----w C:\Arquivos de programas\MSBuild

2007-08-25 01:13 --------- d-----w C:\Arquivos de programas\Windows Sidebar

2007-08-21 06:17 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll

2007-08-20 12:48 --------- d-----w C:\Arquivos de programas\DVD Decrypter

2007-08-18 02:05 --------- d-----w C:\Documents and Settings\Administrador\Dados de aplicativos\Ahead

2007-08-17 20:30 --------- d-----w C:\Arquivos de programas\Java

2007-08-17 19:56 --------- d-----w C:\Arquivos de programas\HP

2007-08-17 19:56 --------- d-----w C:\Arquivos de programas\Hewlett-Packard

2007-07-30 22:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll

2007-07-30 22:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll

2007-07-30 22:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe

2007-07-30 22:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll

2007-07-30 22:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll

2007-07-30 22:19 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll

2007-07-30 22:19 207,736 ----a-w C:\WINDOWS\system32\muweb.dll

2007-07-30 22:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll

2007-07-30 22:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll

2007-07-30 22:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll

2007-05-06 16:51:04 56 --sh--r C:\WINDOWS\system32\85C41C15A8.sys

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias & legítimas por defeito não são mostradas.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDCPL"="RTHDCPL.EXE" [2006-08-14 03:00 C:\WINDOWS\RTHDCPL.exe]

"avast!"="C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 07:06]

"Windows Defender"="C:\Arquivos de programas\Windows Defender\MSASCui.exe" [2006-11-03 19:20]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CoolSMS"="" []

"SpybotSD TeaTimer"="C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoResolveSearch"=1 (0x1)

R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};\??\C:\Arquivos de programas\CyberLink\PowerDVD\000.fcl

R2 Windowhelp;Windowhelp;c:\Recycler\svchost.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1274a7f0-23da-11dc-958b-0018f37ed92c}]

Auto\command - AdobeR.exe e

AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4f2a87a2-33dc-11dc-95bc-0018f37ed92c}]

Auto\command - AdobeR.exe e

AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8473f72d-0f09-11dc-9548-0018f37ed92c}]

Auto\command - AdobeR.exe e

AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

*Newly Created Service* - CATCHME

.

Conteúdo da pasta 'Tarefas Agendadas'

"2007-10-14 19:30:00 C:\WINDOWS\Tasks\Advanced WindowsCare V2 Pro.job"

- C:\Arquivos de programas\IObit\Advanced WindowsCare V2 Pro\AutoCare.exe

"2007-10-12 23:00:00 C:\WINDOWS\Tasks\AwcProUpdate.job"

- C:\Arquivos de programas\IObit\Advanced WindowsCare V2 Pro\AutoUpdate.exe

"2007-10-14 14:49:37 C:\WINDOWS\Tasks\MP Scheduled Scan.job"

- C:\Arquivos de programas\Windows Defender\MpCmdRun.exe

"2007-10-14 22:25:00 C:\WINDOWS\Tasks\User_Feed_Synchronization-{A07E80E1-A094-4F80-A394-6C5BB5257E4A}.job"

- C:\WINDOWS\system32\msfeedssync.exe

.

**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-10-14 19:29:30

Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros ocultos ...

Varredura completada com sucesso

Ficheiros ocultos: 0

**************************************************************************

.

Tempo para conclusão: 2007-10-14 19:29:59

.

--- E O F ---

e o do Hijackthis:

Logfile of HijackThis v1.99.1

Scan saved at 19:32:46, on 14/10/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Bonjour\mDNSResponder.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\RTHDCPL.EXE

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\Arquivos de programas\Windows Defender\MSASCui.exe

C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

C:\Arquivos de programas\CyberLink\Shared files\RichVideo.exe

c:\Recycler\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\Arquivos de programas\MSN Messenger\usnsvc.exe

C:\Arquivos de programas\Nero\Nero 7\Core\nero.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

C:\Arquivos de programas\Nero\Nero 7\Core\nero.exe

C:\WINDOWS\explorer.exe