[Arquivado] internet lenta, muito lenta....

HenriqueSPFC · Julho 3, 2008

Logfile of HijackThis v1.99.1

Scan saved at 21:53 Henrique, on 2/7/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Premium\avguard.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Premium\sched.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Premium\avesvc.exe

C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\Arquivos de programas\Windows Live\Messenger\usnsvc.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Arquivos de programas\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Arquivos de programas\Winamp\winampa.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Premium\avgnt.exe

C:\Arquivos de programas\Java\jre1.6.0_05\bin\jusched.exe

C:\Arquivos de programas\PowerISO\PWRISOVM.EXE

C:\Arquivos de programas\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\SRS Labs\Audio Sandbox\SRSSSC.exe

C:\Arquivos de programas\NitroPC\NitroPC.exe

C:\Arquivos de programas\DAEMON Tools Lite\daemon.exe

C:\Arquivos de programas\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Arquivos de programas\Google\Google Updater\GoogleUpdater.exe

C:\Arquivos de programas\Orbitdownloader\orbitdm.exe

C:\Arquivos de programas\Orbitdownloader\orbitnet.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

C:\Arquivos de programas\VHLabs\VHScrCap\VHScrCapDlg.exe

C:\WINDOWS\system32\taskmgr.exe

D:\Downloads Programas\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.spfc.com.br

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orkut.com.br/Community.aspx?cmm=56747661

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\fservice.exe

O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Arquivos de programas\Orbitdownloader\orbitcth.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar1.dll

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [ATIPTA] C:\Arquivos de programas\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [WinampAgent] "C:\Arquivos de programas\Winamp\winampa.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Arquivos de programas\Avira\AntiVir PersonalEdition Premium\avgnt.exe" /min

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [startCCC] "C:\Arquivos de programas\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"

O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Arquivos de programas\PowerISO\PWRISOVM.EXE

O4 - HKLM\..\Run: [bootSkin Startup Jobs] "C:\ARQUIV~1\Stardock\WINCUS~1\BootSkin\BootSkin.exe" /StartupJobs

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [sRS Audio Sandbox] "C:\Arquivos de programas\SRS Labs\Audio Sandbox\SRSSSC.exe" /hideme

O4 - HKCU\..\Run: [NitroPC] "C:\Arquivos de programas\NitroPC\NitroPC.exe" -minimized

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Arquivos de programas\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKCU\..\Run: [DWQueuedReporting] "C:\ARQUIV~1\ARQUIV~1\MICROS~1\DW\dwtrig20.exe" -t

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Google Updater.lnk = C:\Arquivos de programas\Google\Google Updater\GoogleUpdater.exe

O4 - Global Startup: Orbit.lnk = C:\Arquivos de programas\Orbitdownloader\orbitdm.exe

O8 - Extra context menu item: &Download by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/201

O8 - Extra context menu item: &Grab video by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/204

O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/203

O8 - Extra context menu item: Down&load all by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/202

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O10 - Broken Internet access because of LSP provider 'avsda.dll' missing

O11 - Options group: [iNTERNATIONAL] International*

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD40/JSCDL/jre/6u...ows-i586-jc.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{F85F72B0-623E-41CF-9829-1DAE1F47874F}: NameServer = 200.204.0.10 200.204.0.138

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: AntiVir PersonalEdition Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir PersonalEdition Premium\avmailc.exe

O23 - Service: AntiVir PersonalEdition Premium Scheduler (AntiVirScheduler) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir PersonalEdition Premium\sched.exe

O23 - Service: AntiVir PersonalEdition Premium Guard (AntiVirService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir PersonalEdition Premium\avguard.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: AntiVir PersonalEdition Premium MailGuard helper service (AVEService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir PersonalEdition Premium\avesvc.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

Obrigado.

jgarcia · Julho 3, 2008

Opa HenriqueSPFC,

Baixe o ComboFix em:

ComboFix

1) Desabilite o seu anti-vírus temporariamente;

2) Dê um duplo-clique no combofix.exe e tecle "1" para prosseguir. O processo vai durar, em média, 10 minutos;

3) O ComboFix reiniciará o PC automaticamente, a fim de que o processo de remoção seja finalizado (somente se houver infecção);

4) Quando a varredura acabar, será gerado um log, que estará em C:\ComboFix.txt;

5) Não clique na janela do ComboFix, nem feche clicando no X, enquanto a ferramenta estiver sendo executada, pois isto implicará na desconfiguração de seu desktop (ele ficará todo branco);

6) Para parar ou sair do ComboFix, tecle "N";

7) Reabilite o seu anti-vírus;

8) Preciso que você cole o conteúdo do ComboFix.txt em sua próxima resposta, juntamente com um log do Hijackthis.

Abraços.

HenriqueSPFC · Julho 4, 2008

Muito obrigado pela atenção

percebi q a varredura do Combofix eliminou as barras do ie7 como a barra do google

segue o ComboFix.txt

ComboFix 08-07-03.5 - Henrique 2008-07-04 13:35:26.1 - NTFSx86

Executando de: D:\Downloads Programas\ComboFix.exe

* Criado um novo ponto de restauro

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\WINDOWS\ktd32.atm

.

((((((((((((((((((((((( Ficheiros criados de 2008-06-04 to 2008-07-04 ))))))))))))))))))))))))))))))))

.

2008-07-04 12:33 . 2008-07-04 12:33 <DIR> d-------- C:\Documents and Settings\Daniela\Dados de aplicativos\AdobeUM

2008-07-03 13:27 . 2008-07-04 13:28 <DIR> d-------- C:\Documents and Settings\Henrique\Dados de aplicativos\AdobeUM

2008-07-03 10:10 . 2008-07-03 10:10 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\MSScanAppDataDir

2008-06-30 19:45 . 2008-06-30 19:45 <DIR> d-------- C:\Arquivos de programas\DAEMON Tools Lite

2008-06-30 19:38 . 2008-06-30 19:38 <DIR> d-------- C:\Documents and Settings\Henrique\Dados de aplicativos\DAEMON Tools

2008-06-30 19:38 . 2008-06-30 19:38 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys

2008-06-30 01:22 . 2008-06-30 19:31 3,639 --a------ C:\WINDOWS\VGSCDAPI.VXD

2008-06-27 19:52 . 2008-07-03 09:06 421 --a------ C:\WINDOWS\ODBC.INI

2008-06-27 19:51 . 2003-06-19 01:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll

2008-06-27 19:47 . 2008-06-27 19:47 <DIR> d-------- C:\Arquivos de programas\Microsoft.NET

2008-06-27 19:39 . 2008-06-27 19:39 <DIR> dr-h----- C:\MSOCache

2008-06-26 22:21 . 2008-06-26 22:21 <DIR> d-------- C:\Arquivos de programas\QuickTime

2008-06-22 23:07 . 2008-06-26 13:00 <DIR> d-------- C:\Arquivos de programas\BMO

2008-06-14 10:19 . 2008-06-27 19:48 <DIR> d-------- C:\WINDOWS\SHELLNEW

2008-06-12 22:43 . 2008-06-26 13:01 <DIR> d-------- C:\Arquivos de programas\Easy Audio Cutter

2008-06-12 22:35 . 2008-06-12 22:35 <DIR> d-------- C:\Arquivos de programas\TFM

2008-06-12 21:47 . 2008-06-12 21:47 <DIR> d-------- C:\Documents and Settings\Henrique\Dados de aplicativos\GrabPro

2008-06-10 20:52 . 2008-06-14 14:59 272,384 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

2008-06-10 01:01 . 2008-06-10 05:33 <DIR> d-------- C:\Arquivos de programas\GameSpy Arcade

2008-06-10 00:44 . 2008-06-10 00:44 <DIR> d-------- C:\Arquivos de programas\Sierra

2008-06-08 20:51 . 2008-06-08 20:51 54,156 --ah----- C:\WINDOWS\QTFont.qfn

2008-06-08 20:51 . 2008-06-08 20:51 1,409 --a------ C:\WINDOWS\QTFont.for

2008-06-06 13:42 . 2008-06-30 20:23 2,077 --a------ C:\foto.jpeg

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-07-04 16:29 --------- d-----w C:\Documents and Settings\Henrique\Dados de aplicativos\Orbit

2008-07-04 16:28 --------- d---a-w C:\Documents and Settings\All Users\Dados de aplicativos\TEMP

2008-07-04 16:24 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Adobe

2008-07-04 15:46 --------- d-----w C:\Arquivos de programas\Google

2008-07-04 15:35 --------- d-----w C:\Documents and Settings\Daniela\Dados de aplicativos\Orbit

2008-07-03 23:25 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Google Updater

2008-07-02 20:16 --------- d-----w C:\Arquivos de programas\Xvid

2008-06-27 10:42 --------- d-----w C:\Arquivos de programas\eMule

2008-06-26 16:02 --------- d-----w C:\Arquivos de programas\Orbitdownloader

2008-06-26 16:01 --------- d-----w C:\Arquivos de programas\forsage3

2008-06-16 16:46 --------- d-----w C:\Arquivos de programas\GameVicio

2008-06-16 01:32 --------- d--h--w C:\Arquivos de programas\InstallShield Installation Information

2008-06-16 01:00 --------- d-----w C:\Arquivos de programas\EA SPORTS

2008-06-14 17:59 272,384 ------w C:\WINDOWS\system32\drivers\bthport.sys

2008-06-01 17:05 --------- d-----w C:\Arquivos de programas\NitroPC

2008-05-28 22:33 --------- d-----w C:\Documents and Settings\Henrique\Dados de aplicativos\uTorrent

2008-05-23 10:55 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Apple Computer

2008-05-13 23:22 163,712 ----a-w C:\WINDOWS\system32\drivers\vidstub.sys

2008-05-13 22:50 --------- d-----w C:\Arquivos de programas\Stardock

2008-05-13 22:50 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Stardock

2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys

2008-04-17 19:19 0 ----a-r C:\logwmemory.bin

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

REGEDIT4

*Nota* entradas vazias & legítimas por defeito não são mostradas.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:45 15360]

"MsnMsgr"="C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe" [2007-11-07 15:34 3739672]

"swg"="C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-17 01:13 68856]

"SRS Audio Sandbox"="C:\Arquivos de programas\SRS Labs\Audio Sandbox\SRSSSC.exe" [2007-10-26 16:04 4354048]

"NitroPC"="C:\Arquivos de programas\NitroPC\NitroPC.exe" [2007-11-15 14:03 1975824]

"DAEMON Tools Lite"="C:\Arquivos de programas\DAEMON Tools Lite\daemon.exe" [2008-04-01 06:39 486856]

"updateMgr"="C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]

"ATIPTA"="C:\Arquivos de programas\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-11 21:10 344064]

"WinampAgent"="C:\Arquivos de programas\Winamp\winampa.exe" [2008-04-01 15:49 36352]

"avgnt"="C:\Arquivos de programas\Avira\AntiVir PersonalEdition Premium\avgnt.exe" [2007-08-31 12:25 249896]

"SunJavaUpdateSched"="C:\Arquivos de programas\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]

"StartCCC"="C:\Arquivos de programas\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 12:17 61440]

"PWRISOVM.EXE"="C:\Arquivos de programas\PowerISO\PWRISOVM.EXE" [2008-03-14 20:50 233472]

"BootSkin Startup Jobs"="C:\ARQUIV~1\Stardock\WINCUS~1\BootSkin\BootSkin.exe" [2004-04-26 16:21 270336]

"SoundMan"="SOUNDMAN.EXE" [2006-01-11 15:08 577536 C:\WINDOWS\soundman.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:45 15360]

C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\

Adobe Reader Speed Launch.lnk - C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 Henrique 29696]

Google Updater.lnk - C:\Arquivos de programas\Google\Google Updater\GoogleUpdater.exe [2008-04-17 01:13:16 Henrique 124400]

Orbit.lnk - C:\Arquivos de programas\Orbitdownloader\orbitdm.exe [2008-04-16 23:28:17 Henrique 1678536]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.YV12"= yv12vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Arquivos de programas\\Orbitdownloader\\orbitdm.exe"=

"C:\\Arquivos de programas\\Orbitdownloader\\orbitnet.exe"=

"C:\\Arquivos de programas\\uTorrent\\uTorrent.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Soldat\\Soldat.exe"=

"C:\\Arquivos de programas\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=

"C:\\Arquivos de programas\\Hamachi\\hamachi.exe"=

"C:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"=

"C:\\Arquivos de programas\\eMule\\emule.exe"=

R1 BIOS;BIOS;C:\WINDOWS\System32\drivers\BIOS.sys [2005-03-16 03:23]

*Newly Created Service* - CATCHME

.

Conteúdo da pasta 'Tarefas Agendadas'

"2008-07-04 03:20:01 C:\WINDOWS\Tasks\At1.job"