[Resolvido!] Máquina muito lenta

Tigre13 · Dezembro 13, 2008

Olá,

Segue somente o log do MoveIt, pois o arquivo ayu9e8sz.sys para analisar no VirusTotal,

não foi encontrato mais no PC, procurei antes e depois do MoveIt e não localizou.

========== PROCESSES ==========

Process explorer.exe killed successfully.

========== FILES ==========

File/Folder C:\Arquivos de programas\AdVantage not found.

File/Folder C:\Arquivos de programas\AdVantage\AdVantage.exe not found.

File/Folder Z:\ddtnvn.exe not found.

C:\FOUND.001 moved successfully.

C:\FOUND.000 moved successfully.

C:\windows\system32\cftm.exe moved successfully.

File/Folder C:\wttrqla.exe not found.

C:\Qoobox\LastRun moved successfully.

C:\Qoobox\TestC moved successfully.

C:\Qoobox\Test moved successfully.

C:\Qoobox\Quarantine\Registry_backups moved successfully.

C:\Qoobox\Quarantine moved successfully.

C:\Qoobox moved successfully.

========== REGISTRY ==========

Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage\\ deleted successfully.

Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\##Zero#ARQUIVOS (D)\\ deleted successfully.

========== COMMANDS ==========

File delete failed. C:\DOCUME~1\Um\CONFIG~1\Temp\etilqs_c7Q6zZeTAhqHAvk scheduled to be deleted on reboot.

File delete failed. C:\DOCUME~1\Um\CONFIG~1\Temp\Perflib_Perfdata_9ec.dat scheduled to be deleted on reboot.

User's Temp folder emptied.

User's Temporary Internet Files folder emptied.

User's Internet Explorer cache folder emptied.

Local Service Temp folder emptied.

Local Service Temporary Internet Files folder emptied.

File delete failed. C:\windows\temp\Perflib_Perfdata_fc.dat scheduled to be deleted on reboot.

File delete failed. C:\windows\temp\vmware-vmount.log scheduled to be deleted on reboot.

File delete failed. C:\windows\temp\Perflib_Perfdata_7bc.dat scheduled to be deleted on reboot.

Windows Temp folder emptied.

Java cache emptied.

FireFox cache emptied.

Temp folders emptied.

Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12132008_212944

Files moved on Reboot...

File C:\DOCUME~1\Um\CONFIG~1\Temp\etilqs_c7Q6zZeTAhqHAvk not found!

File C:\DOCUME~1\Um\CONFIG~1\Temp\Perflib_Perfdata_9ec.dat not found!

File C:\windows\temp\Perflib_Perfdata_fc.dat not found!

File move failed. C:\windows\temp\vmware-vmount.log scheduled to be moved on reboot.

C:\windows\temp\Perflib_Perfdata_7bc.dat moved successfully.

MGuitar · Dezembro 14, 2008

- Baixe o programa que upei no host aqui abaixo e salve-o em seu desktop:

http://rapidshare.com/files/173342457/OAD.exe.html

- Dê um duplo clique em OAD.exe e abrirá uma janela do MS-DOS para você;

- Digite, na janela que abriu, o comando abaixo (do jeito que está aí) e tecle Enter:

ayu9e8sz.sys

- Tecle 6 e dê um Enter. Aguarde;

- Será automaticamente aberto um log no bloco de notas para você. Este log estará também em C:\resultat.txt.

Cole este log em sua próxima resposta.

Delete a pasta C:\_OTMoveIt.

Faça um novo log do RSIT e cole-o em sua próxima resposta, juntamente com o resultat.txt.

Tigre13 · Dezembro 15, 2008

Olá,

seg 15/12/2008 ---- 1:38:18,49

----------------------------------

§§§§§§ [ayu9e8sz.sys] §§§§§§

----------------------------------

[X] Registre

-------------- [ ] rapide

-- Fichier --- [ ] disque systeme

------------- [X] complete

********************

[Registre]

********************

Aucune entrée détectée

*******************

[Fichier]

*******************

*********************

[Même date]

*********************

Aucun fichier créé à la même date détecté

Outil Aide Diagnostic By !aur3n7 Version 1.1

----------------------------------

§§§§§ Fin Rapport §§§§§

----------------------------------

Logfile of random's system information tool 1.04 (written by random/random)

Run by Um at 2008-12-15 01:42:25

Microsoft Windows XP Professional Service Pack 2

System drive C: has 9 GB (23%) free of 38 GB

Total RAM: 1023 MB (43% free)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 01:42:27, on 15/12/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Normal

Running processes:

C:\windows\System32\smss.exe

C:\windows\system32\csrss.exe

C:\windows\system32\winlogon.exe

C:\windows\system32\services.exe

C:\windows\system32\lsass.exe

C:\windows\system32\svchost.exe

C:\windows\System32\svchost.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

C:\windows\system32\svchost.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccSetMgr.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccEvtMgr.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\ARQUIV~1\GbPlugin\GbpSv.exe

C:\windows\system32\spoolsv.exe

C:\Arquivos de programas\Symantec AntiVirus\DefWatch.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\Arquivos de programas\CDBurnerXP\NMSAccessU.exe

C:\windows\system32\nvsvc32.exe

C:\Arquivos de programas\Symantec AntiVirus\Rtvscan.exe

C:\Arquivos de programas\VMware\VMware Workstation\vmware-authd.exe

C:\Arquivos de programas\Arquivos comuns\VMware\VMware Virtual Image Editing\vmount2.exe

C:\WINDOWS\system32\vmnat.exe

C:\WINDOWS\system32\vmnetdhcp.exe

C:\windows\Explorer.EXE

C:\windows\system32\ctfmon.exe

C:\Arquivos de programas\Analog Devices\Core\smax4pnp.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe

C:\Arquivos de programas\Fábrica de Bits\ACORDA\acorda.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccApp.exe

C:\ARQUIV~1\SYMANT~1\VPTray.exe

C:\Arquivos de programas\Google\Gmail Notifier\gnotify.exe

C:\windows\system32\RUNDLL32.EXE

C:\Arquivos de programas\Java\jre6\bin\jusched.exe

C:\Arquivos de programas\Microsoft Money\System\reminder.exe

C:\Documents and Settings\Um\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe

C:\Arquivos de programas\SpeedFan\speedfan.exe

C:\windows\System32\alg.exe

C:\Documents and Settings\Um\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe

C:\WINDOWS\explorer.exe

C:\windows\system32\NOTEPAD.EXE

C:\Documents and Settings\Um\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\Um\Desktop\RSIT.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\HiJack\Um.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R3 - URLSearchHook: Barra de Ferramentas do Yahoo! com bloqueador de pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre6\bin\ssv.dll

O2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\Arquivos de programas\GbPlugin\gbiehcef.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe

O4 - HKLM\..\Run: [soundMAXPnP] C:\Arquivos de programas\Analog Devices\Core\smax4pnp.exe

O4 - HKLM\..\Run: [soundMAX] "C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe" /tray

O4 - HKLM\..\Run: [ACORDA] C:\Arquivos de programas\Fábrica de Bits\ACORDA\acorda.exe

O4 - HKLM\..\Run: [ccApp] "C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [vptray] C:\ARQUIV~1\SYMANT~1\VPTray.exe

O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Arquivos de programas\Google\Gmail Notifier\gnotify.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre6\bin\jusched.exe"

O4 - HKCU\..\Run: [Reminder] C:\Arquivos de programas\Microsoft Money\System\reminder.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Um\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe" /c

O4 - Global Startup: SpeedFan.lnk = C:\Arquivos de programas\SpeedFan\speedfan.exe

O8 - Extra context menu item: Add to EverNote - res://C:\Arquivos de programas\EverNote\EverNote\enbar.dll/2000

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Add to EverNote - {A5ABA0BB-F195-40d8-A5E9-0801153E6597} - C:\Arquivos de programas\EverNote\EverNote\enbar.dll

O9 - Extra 'Tools' menuitem: Add to EverNote - {A5ABA0BB-F195-40d8-A5E9-0801153E6597} - C:\Arquivos de programas\EverNote\EverNote\enbar.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} (GbpDistObj Class) - https://imagem.caixa.gov.br/cab/gbpdist.cab

O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = UM

O17 - HKLM\Software\..\Telephony: DomainName = UM

O17 - HKLM\System\CCS\Services\Tcpip\..\{3FC3B0ED-1D34-4E79-A979-0B23D10D35BF}: NameServer = 192.168.1.254

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = UM

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = UM

O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = UM

O17 - HKLM\System\CS4\Services\Tcpip\Parameters: Domain = UM

O20 - Winlogon Notify: GbPluginCef - C:\Arquivos de programas\GbPlugin\gbiehcef.dll

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccSetMgr.exe

O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Arquivos de programas\Symantec AntiVirus\DefWatch.exe

O23 - Service: Gbp Service (GbpSv) - Unknown owner - C:\ARQUIV~1\GbPlugin\GbpSv.exe

O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\ARQUIV~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: NMSAccessU - Unknown owner - C:\Arquivos de programas\CDBurnerXP\NMSAccessU.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe

O23 - Service: SAVRoam (SavRoam) - symantec - C:\Arquivos de programas\Symantec AntiVirus\SavRoam.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Arquivos de programas\Symantec AntiVirus\Rtvscan.exe

O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\windows\System32\TuneUpDefragService.exe

O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Arquivos de programas\VMware\VMware Workstation\vmware-ufad.exe

O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Arquivos de programas\VMware\VMware Workstation\vmware-authd.exe

O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe

O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Arquivos de programas\Arquivos comuns\VMware\VMware Virtual Image Editing\vmount2.exe

O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe

--

End of file - 9999 bytes

======Scheduled tasks folder======

C:\windows\tasks\1-Click Maintenance.job

C:\windows\tasks\GoogleUpdateTaskUser.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]

Spybot-S&D IE Protection - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll [2008-09-15 1562960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]

Java Plug-In SSV Helper - C:\Arquivos de programas\Java\jre6\bin\ssv.dll [2008-12-02 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C41A1C0E-EA6C-11D4-B1B8-444553540003}]

GbIehObj Class - C:\Arquivos de programas\GbPlugin\gbiehcef.dll [2008-04-01 337992]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java Plug-In 2 SSV Helper - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll [2008-12-02 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

JQSIEStartDetectorImpl Class - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-12-02 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"High Definition Audio Property Page Shortcut"=C:\windows\system32\HDAShCut.exe [2004-10-27 61952]

"SoundMAXPnP"=C:\Arquivos de programas\Analog Devices\Core\smax4pnp.exe [2005-05-20 925696]

"SoundMAX"=C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe [2005-09-07 716800]

"ACORDA"=C:\Arquivos de programas\Fábrica de Bits\ACORDA\acorda.exe [2004-09-04 483328]

"ccApp"=C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccApp.exe [2006-03-07 53408]

"vptray"=C:\ARQUIV~1\SYMANT~1\VPTray.exe [2006-03-17 124656]

"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"=C:\Arquivos de programas\Google\Gmail Notifier\gnotify.exe [2005-07-15 479232]

"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-05-03 13529088]

"nwiz"=nwiz.exe /install []

"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-05-03 86016]

"SunJavaUpdateSched"=C:\Arquivos de programas\Java\jre6\bin\jusched.exe [2008-12-02 136600]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"Reminder"=C:\Arquivos de programas\Microsoft Money\System\reminder.exe [1998-07-25 36864]

"ctfmon.exe"=C:\windows\system32\ctfmon.exe [2004-08-04 15360]

"Google Update"=C:\Documents and Settings\Um\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe [2008-09-09 133104]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]

C:\Arquivos de programas\DAEMON Tools\daemon.exe [2007-08-16 167368]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVD43]

C:\Arquivos de programas\DVD Region+CSS Free\DVDRegionFree.exe [2004-10-22 278016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]

C:\Arquivos de programas\Nero\Nero 7\InCD\InCD.exe [2005-10-20 871936]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

C:\windows\system32\dumprep 0 -k []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

C:\Arquivos de programas\Messenger\msmsgs.exe [2004-10-13 1694208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^KYESCAN.lnk]

C:\ARQUIV~1\ScannerU\KYESCAN.exe [2002-02-01 172032]

C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar

SpeedFan.lnk - C:\Arquivos de programas\SpeedFan\speedfan.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ GbPluginCef]

C:\Arquivos de programas\GbPlugin\gbiehcef.dll [2008-04-01 337992]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LMIinit]

C:\windows\system32\LMIinit.dll [2007-11-15 87352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]

C:\WINDOWS\system32\NavLogon.dll [2006-03-17 43760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{93994DE8-8239-4655-B1D1-5F4E91300429}"=C:\ARQUIV~1\DVDREG~1\DVDShell.dll [2004-10-09 49152]

"{E37CB5F0-51F5-4395-A808-5FA49E399003}"=C:\Arquivos de programas\GbPlugin\gbiehcef.dll [2008-04-01 337992]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PSEXESVC]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"C:\WINDOWS\Network Diagnostic\xpnetdiag.exe"="C:\WINDOWS\Network Diagnostic\xpnetdiag.exe:LocalSubNet:Enabled:@xpsp3res.dll,-20000"

"C:\Arquivos de programas\VideoLAN\VLC\vlc.exe"="C:\Arquivos de programas\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"

"C:\Arquivos de programas\Mozilla Firefox\firefox.exe"="C:\Arquivos de programas\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"

"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:LocalSubNet:Disabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2008-12-15 01:38:18 ----A---- C:\resultat.txt

2008-12-14 17:49:36 ----SHD---- C:\FOUND.000

2008-12-13 15:30:06 ----D---- C:\rsit

2008-12-13 00:16:55 ----D---- C:\ComboFix

2008-12-13 00:16:54 ----A---- C:\windows\system32\CF18637.exe

2008-12-13 00:06:36 ----A---- C:\windows\system32\CF16616.exe

2008-12-11 16:36:12 ----A---- C:\windows\ntbtlog.txt

2008-12-11 11:07:46 ----HD---- C:\windows\$NtUninstallKB952069_WM9$

2008-12-11 11:07:41 ----HD---- C:\windows\$NtUninstallKB955839$

2008-12-11 11:06:15 ----HD---- C:\windows\$NtUninstallKB954600$

2008-12-11 11:06:11 ----A---- C:\windows\imsins.BAK

2008-12-11 11:06:08 ----HD---- C:\windows\$NtUninstallKB956802$

2008-12-09 16:27:30 ----A---- C:\windows\system32\CF30496.exe

2008-12-09 16:09:57 ----A---- C:\windows\NIRCMD.exe

2008-12-09 16:09:50 ----D---- C:\KomboFix

2008-12-09 16:09:50 ----A---- C:\windows\system32\CF27038.exe

2008-12-09 16:03:19 ----A---- C:\windows\system32\CF25761.exe

2008-12-08 15:49:25 ----D---- C:\HiJack

2008-12-08 12:05:54 ----A---- C:\windows\wininit.ini

2008-12-04 16:57:50 ----A---- C:\windows\system32\CF1969.exe

2008-12-03 13:44:25 ----A---- C:\windows\system32\CF9606.exe

2008-12-03 13:42:45 ----SHD---- C:\windows\CSC

2008-12-03 13:38:28 ----A---- C:\windows\system32\CF8440.exe

2008-12-02 20:41:46 ----D---- C:\Documents and Settings\Um\Dados de aplicativos\WinRAR

2008-12-02 20:36:49 ----D---- C:\windows\ERUNT

2008-12-02 20:07:50 ----A---- C:\windows\system32\CF31960.exe

2008-12-02 19:05:35 ----A---- C:\windows\system32\CF19760.exe

2008-12-02 17:23:26 ----D---- C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy

2008-12-02 17:23:26 ----D---- C:\Arquivos de programas\Spybot - Search & Destroy

2008-12-02 15:51:49 ----D---- C:\cmdcons

2008-12-02 15:49:29 ----A---- C:\windows\zip.exe

2008-12-02 15:49:29 ----A---- C:\windows\VFIND.exe

2008-12-02 15:49:29 ----A---- C:\windows\SWXCACLS.exe

2008-12-02 15:49:29 ----A---- C:\windows\SWSC.exe

2008-12-02 15:49:29 ----A---- C:\windows\SWREG.exe

2008-12-02 15:49:29 ----A---- C:\windows\sed.exe

2008-12-02 15:49:29 ----A---- C:\windows\grep.exe

2008-12-02 15:49:29 ----A---- C:\windows\fdsv.exe

2008-12-02 15:48:52 ----D---- C:\windows\ERDNT

2008-12-02 15:48:51 ----A---- C:\windows\system32\CF13984.exe

======List of files/folders modified in the last 1 months======

2008-12-14 02:49:04 ----A---- C:\windows\SchedLgU.Txt

2008-12-09 21:24:38 ----A---- C:\windows\system32\MRT.exe

2008-12-08 02:01:30 ----A---- C:\windows\NeroDigital.ini

2008-12-07 19:16:26 ----A---- C:\windows\DVDRegionFree.INI

2008-12-02 21:08:00 ----A---- C:\windows\system32\javaws.exe

2008-12-02 21:08:00 ----A---- C:\windows\system32\javaw.exe

2008-12-02 21:08:00 ----A---- C:\windows\system32\java.exe

2008-12-02 21:08:00 ----A---- C:\windows\system32\deploytk.dll

2008-11-29 16:24:32 ----RAH---- C:\windows\system32\cdplayer.exe.manifest

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Arquivos de programas\Arquivos comuns\Symantec Shared\EENGINE\eeCtrl.sys []

R1 InCDPass;InCDPass; C:\windows\system32\drivers\InCDPass.sys [2005-10-14 29440]

R1 incdrm;InCD Reader; C:\windows\system32\drivers\InCDRm.sys [2005-10-14 22016]

R1 intelppm;Driver de Processador Intel; C:\windows\system32\DRIVERS\intelppm.sys [2004-08-04 40192]

R1 PQNTDrv;PQNTDrv; C:\windows\system32\drivers\PQNTDrv.sys [2002-09-16 4228]

R1 SAVRT;SAVRT; \??\C:\Arquivos de programas\Symantec AntiVirus\savrt.sys []

R1 SAVRTPEL;SAVRTPEL; \??\C:\Arquivos de programas\Symantec AntiVirus\Savrtpel.sys []

R1 SPBBCDrv;SPBBCDrv; \??\C:\Arquivos de programas\Arquivos comuns\Symantec Shared\SPBBC\SPBBCDrv.sys []

R1 SYMTDI;SYMTDI; C:\windows\System32\Drivers\SYMTDI.SYS [2006-01-24 195776]

R2 BulkUsb;Genius ColorPage USB Scanner; C:\windows\system32\DRIVERS\usbscan.sys [2004-08-03 15104]

R2 hcmon;VMware hcmon; \??\C:\WINDOWS\system32\Drivers\hcmon.sys []

R2 LMIRfsDriver;LogMeIn Remote File System Driver; \??\C:\WINDOWS\system32\drivers\LMIRfsDriver.sys []

R2 VMnetBridge;VMware Bridge Protocol; C:\windows\system32\DRIVERS\vmnetbridge.sys [2007-05-01 28592]

R2 VMnetuserif;VMware Network Application Interface; \??\C:\WINDOWS\system32\drivers\vmnetuserif.sys []

R2 VMparport;VMware VMparport; \??\C:\WINDOWS\system32\Drivers\VMparport.sys []

R2 vmx86;VMware vmx86; \??\C:\WINDOWS\system32\Drivers\vmx86.sys []

R2 vstor2;Vstor2 Virtual Storage Driver; \??\C:\Arquivos de programas\Arquivos comuns\VMware\VMware Virtual Image Editing\vstor2.sys []

R2 vstor2-ws60;Vstor2 WS60 Virtual Storage Driver; \??\C:\Arquivos de programas\VMware\VMware Workstation\vstor2-ws60.sys []

R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\windows\system32\drivers\ADIHdAud.sys [2005-10-05 141312]

R3 AEAudioService;AEAudio Service; C:\windows\system32\drivers\AEAudio.sys [2005-03-04 127872]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Arquivos de programas\Arquivos comuns\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys []

R3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver; C:\windows\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]

R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\windows\system32\DRIVERS\HDAudBus.sys [2004-10-27 138240]

R3 lmimirr;lmimirr; C:\windows\system32\DRIVERS\lmimirr.sys [2007-08-03 10144]

R3 MTsensor;ATK0110 ACPI UTILITY; C:\windows\system32\DRIVERS\ASACPI.sys [2004-08-12 5810]

R3 NAVENG;NAVENG; \??\C:\ARQUIV~1\ARQUIV~1\SYMANT~1\VIRUSD~1\20081212.004\naveng.sys []

R3 NAVEX15;NAVEX15; \??\C:\ARQUIV~1\ARQUIV~1\SYMANT~1\VIRUSD~1\20081212.004\navex15.sys []

R3 nv;nv; C:\windows\system32\DRIVERS\nv4_mini.sys [2008-05-02 6554496]

R3 SenFiltService;SenFilt Service; C:\windows\system32\drivers\Senfilt.sys [2005-08-11 393088]

R3 SymEvent;SymEvent; \??\C:\Arquivos de programas\Symantec\SYMEVENT.SYS []

R3 SYMREDRV;SYMREDRV; C:\windows\System32\Drivers\SYMREDRV.SYS [2006-01-24 24768]

R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\windows\system32\DRIVERS\usbehci.sys [2004-08-04 26624]

R3 usbhub;USB2 Enabled Hub; C:\windows\system32\DRIVERS\usbhub.sys [2004-08-04 57600]

R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\windows\system32\DRIVERS\usbuhci.sys [2004-08-04 20480]

R3 vmkbd;VMware kbd; \??\C:\WINDOWS\system32\drivers\VMkbd.sys []

R3 VMnetAdapter;VMware Virtual Ethernet Adapter Driver; C:\windows\system32\DRIVERS\vmnetadapter.sys [2007-05-01 16816]

R4 InCDfs;InCD File System; C:\windows\system32\drivers\InCDFs.sys [2005-10-14 101760]

S2 LMIInfo;LogMeIn Kernel Information Provider; \??\C:\Arquivos de programas\LogMeIn\x86\RaInfo.sys []

S3 akzkzpwr;akzkzpwr; C:\windows\system32\drivers\akzkzpwr.sys []

S3 Asushwio;Asushwio; \??\C:\WINDOWS\system32\drivers\Asushwio.sys []

S3 catchme;catchme; \??\C:\DOCUME~1\Um\CONFIG~1\Temp\catchme.sys []

S3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\windows\system32\drivers\HdAudio.sys [2004-10-27 145920]

S3 usbprint;Microsoft USB PRINTER Class; C:\windows\system32\DRIVERS\usbprint.sys [2004-08-03 25856]

S3 USBSTOR;USB Mass Storage Driver; C:\windows\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]

S4 IntelIde;IntelIde; C:\windows\system32\drivers\IntelIde.sys []

S4 LMIRfsClientNP;LMIRfsClientNP; C:\windows\system32\drivers\LMIRfsClientNP.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ccEvtMgr;Symantec Event Manager; C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccEvtMgr.exe [2006-03-07 192160]

R2 ccSetMgr;Symantec Settings Manager; C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccSetMgr.exe [2006-03-07 169632]

R2 DefWatch;Symantec AntiVirus Definition Watcher; C:\Arquivos de programas\Symantec AntiVirus\DefWatch.exe [2006-03-17 30448]

R2 InCDsrv;InCD Helper; C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe [2005-10-14 670208]

R2 JavaQuickStarterService;Java Quick Starter; C:\Arquivos de programas\Java\jre6\bin\jqs.exe [2008-12-02 152984]

R2 NMSAccessU;NMSAccessU; C:\Arquivos de programas\CDBurnerXP\NMSAccessU.exe [2007-10-12 71096]

R2 NVSvc;NVIDIA Display Driver Service; C:\windows\system32\nvsvc32.exe [2008-05-02 159812]

R2 SPBBCSvc;Symantec SPBBCSvc; C:\Arquivos de programas\Arquivos comuns\Symantec Shared\SPBBC\SPBBCSvc.exe [2006-02-06 1160848]

R2 Symantec AntiVirus;Symantec AntiVirus; C:\Arquivos de programas\Symantec AntiVirus\Rtvscan.exe [2006-03-17 1799408]

R2 UxTuneUp;TuneUp Theme Extension; C:\windows\System32\svchost.exe [2004-08-04 14336]

R2 VMAuthdService;VMware Authorization Service; C:\Arquivos de programas\VMware\VMware Workstation\vmware-authd.exe [2007-05-01 109360]

R2 VMnetDHCP;VMware DHCP Service; C:\WINDOWS\system32\vmnetdhcp.exe [2007-05-01 121648]

R2 vmount2;VMware Virtual Mount Manager Extended; C:\Arquivos de programas\Arquivos comuns\VMware\VMware Virtual Image Editing\vmount2.exe [2007-03-23 269104]

R2 VMware NAT Service;VMware NAT Service; C:\WINDOWS\system32\vmnat.exe [2007-05-01 150320]

S2 GbpSv;Gbp Service; C:\ARQUIV~1\GbPlugin\GbpSv.exe [2008-04-01 46144]

S3 aspnet_state;ASP.NET State Service; C:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]

S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]

S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864]

S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256]

S3 LiveUpdate;LiveUpdate; C:\ARQUIV~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2006-02-23 2045632]

S3 ose;Office Source Engine; C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]

S3 SavRoam;SAVRoam; C:\Arquivos de programas\Symantec AntiVirus\SavRoam.exe [2006-03-17 115952]

S3 SNDSrvc;Symantec Network Drivers Service; C:\Arquivos de programas\Arquivos comuns\Symantec Shared\SNDSrvc.exe [2006-01-24 214720]

S3 TuneUp.Defrag;TuneUp Drive Defrag Service; C:\windows\System32\TuneUpDefragService.exe [2008-05-20 306432]

S3 ufad-ws60;VMware Agent Service; C:\Arquivos de programas\VMware\VMware Workstation\vmware-ufad.exe [2007-04-09 187184]

S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880]

-----------------EOF-----------------

MGuitar · Dezembro 15, 2008

Delete a ferramenta OAD e seu log resultat.txt.

Por favor, repita o scan online no Kaspersky (como passei anteriormente) e poste o relatório final do scan em sua próxima resposta.

Tigre13 · Dezembro 15, 2008

Último relatório do Kaspersky

--------------------------------------------------------------------------------

KASPERSKY ONLINE SCANNER 7 REPORT

Monday, December 15, 2008

Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)

Kaspersky Online Scanner 7 version: 7.0.25.0

Program database last update: Monday, December 15, 2008 14:58:24

Records in database: 1462800

--------------------------------------------------------------------------------

Scan settings:

Scan using the following database: extended

Scan archives: yes

Scan mail databases: yes

Scan area - My Computer:

A:\

C:\

D:\

E:\

F:\

G:\

Scan statistics:

Files scanned: 77616

Threat name: 14

Infected objects: 23

Suspicious objects: 1

Duration of the scan: 01:41:09

File name / Threat name / Threats count

C:\Documents and Settings\All Users\Dados de aplicativos\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A2C0000\4FEC86F3.VBN Infected: Packed.JS.Agent.n 1

C:\Documents and Settings\All Users\Dados de aplicativos\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AB40000\4AFD8B82.VBN Infected: Backdoor.Win32.Rbot.ils 1

C:\Documents and Settings\All Users\Dados de aplicativos\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CA00000\4CFA495F.VBN Infected: Backdoor.Win32.Rbot.uks 1

C:\Documents and Settings\All Users\Dados de aplicativos\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DDC0000\4DFE4FF5.VBN Infected: Trojan-Dropper.Win32.Mudrop.du 1

C:\Documents and Settings\All Users\Dados de aplicativos\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\02140000\4B357F05.VBN Infected: Trojan.Win32.Autoit.fi 1

C:\Documents and Settings\All Users\Dados de aplicativos\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F2C0000\4F3D67EB.VBN Infected: Trojan-Spy.Win32.Agent.cse 1

C:\Documents and Settings\All Users\Dados de aplicativos\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F2C0001\4F3D67F4.VBN Infected: Trojan-Spy.Win32.Agent.cse 1

C:\Documents and Settings\All Users\Dados de aplicativos\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0D2C0005\4D3DB34D.VBN Infected: Trojan.Win32.Buzus.aavd 1

C:\Documents and Settings\All Users\Dados de aplicativos\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0D2C0006\4D3DB39B.VBN Infected: Trojan.Win32.Buzus.aavd 1

C:\Documents and Settings\All Users\Dados de aplicativos\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0FDC0000\4FDDF785.VBN Infected: Trojan-Downloader.Win32.Agent.atru 1

C:\Documents and Settings\All Users\Dados de aplicativos\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0FDC0002\4FDE0052.VBN Infected: Trojan-Downloader.Win32.Agent.atru 1

C:\Documents and Settings\All Users\Dados de aplicativos\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0FDC0006\4FDE0079.VBN Infected: Trojan-Downloader.Win32.Agent.atru 1

C:\Documents and Settings\All Users\Dados de aplicativos\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0FDC000A\4FDE00A1.VBN Infected: Trojan-Downloader.Win32.Agent.atru 1

C:\System Volume Information\_restore{7861127C-E3B9-489F-A71F-9422B20404C2}\RP13\A0005910.exe Infected: Trojan.Win32.Autoit.fi 1

C:\Recycled\Dc2\MovedFiles\12132008_212944\FOUND.001\FILE0026.CHK Infected: EICAR-Test-File 1

C:\Recycled\Dc2\MovedFiles\12132008_212944\FOUND.000\FILE0006.CHK Infected: EICAR-Test-File 1

C:\Recycled\Dc2\MovedFiles\12132008_212944\windows\system32\cftm.exe Infected: Trojan.Win32.Autoit.gc 1

C:\KomboFix\N_\13700 Infected: EICAR-Test-File 1

D:\Backup\emails\Incred Mail 05-06-2008\IM\Identities\{89740109-BA9F-417F-9018-2AB3A53EAE9F}\Message Store\Message Store\Attachments\LogMeIn.zip Infected: not-a-virus:RemoteAdmin.Win32.RemotelyAnywhere.a 1

D:\Backup\emails\Incred Mail 05-06-2008\IM\Identities\{89740109-BA9F-417F-9018-2AB3A53EAE9F}\Message Store\Message Store\Attachments\LogMeIn.zip Infected: not-a-virus:RemoteAdmin.Win32.RemotelyAnywhere.c 1

D:\Backup\emails\Outlook Express 02-05-2008\Caixa de entrada.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 1

D:\System Volume Information\_restore{7861127C-E3B9-489F-A71F-9422B20404C2}\RP13\A0005914.exe Infected: Trojan.Win32.Autoit.fi 1

D:\System Volume Information\_restore{7861127C-E3B9-489F-A71F-9422B20404C2}\RP13\A0005915.exe Infected: Trojan.Win32.Autoit.fj 1

E:\System Volume Information\_restore{7861127C-E3B9-489F-A71F-9422B20404C2}\RP13\A0005913.exe Infected: Trojan.Win32.Autoit.fi 1

The selected area was scanned.

MGuitar · Dezembro 15, 2008

Vá em Meu Computador e clique no menu Ferramentas > Opções de pasta > Modo de exibição. Marque a opção Mostrar pastas e arquivos ocultos e dê um OK. Vá na pasta Quarentine, destacada abaixo, e delete todos os arquivos dentro da pasta:

C:\Documents and Settings\All Users\Dados de aplicativos\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine

Vá em Iniciar > Executar, digite: sysdm.cpl e dê um OK. Clique na aba Restauração do Sistema e marque a opção Desativar restauração do sistema. Deixe esta opção marcada até terminarmos aqui.

● Execute a ferramenta OTMoveIt3 e copie este conteúdo abaixo para a janela do programa:

:FilesC:\Recycled\Dc2\MovedFilesC:\Recycled\Dc2\MovedFilesC:\Recycled\Dc2\MovedFilesC:\KomboFix:Commands [emptytemp][Reboot]

● Clique no botão MoveIt;

● Se aparecer uma mensagem para reiniciar o computador, reinicie-o;

● Na sua proxima resposta, copie e cole o todo o conteúdo que está em Results;

● Se o computador reiniciou, vá na pasta C:\_OTMoveIt\MovedFiles, e abra o mais recente arquivo .log presente. Copie e cole todo o conteúdo desse arquivo.

Cole também um novo log do RSIT.

Tigre13 · Dezembro 15, 2008

Olá, aqui vai os novos relatórios:

========== FILES ==========

C:\Recycled\Dc2\MovedFiles\12132008_212944\Qoobox\Quarantine\Registry_backups moved successfully.

C:\Recycled\Dc2\MovedFiles\12132008_212944\Qoobox\Quarantine moved successfully.

C:\Recycled\Dc2\MovedFiles\12132008_212944\Qoobox\Test moved successfully.

C:\Recycled\Dc2\MovedFiles\12132008_212944\Qoobox\TestC moved successfully.

C:\Recycled\Dc2\MovedFiles\12132008_212944\Qoobox\LastRun moved successfully.

C:\Recycled\Dc2\MovedFiles\12132008_212944\Qoobox moved successfully.

C:\Recycled\Dc2\MovedFiles\12132008_212944\windows\temp moved successfully.

C:\Recycled\Dc2\MovedFiles\12132008_212944\windows\system32 moved successfully.

C:\Recycled\Dc2\MovedFiles\12132008_212944\windows moved successfully.

C:\Recycled\Dc2\MovedFiles\12132008_212944\FOUND.000 moved successfully.

C:\Recycled\Dc2\MovedFiles\12132008_212944\FOUND.001 moved successfully.

C:\Recycled\Dc2\MovedFiles\12132008_212944 moved successfully.

C:\Recycled\Dc2\MovedFiles moved successfully.

File/Folder C:\Recycled\Dc2\MovedFiles not found.

C:\KomboFix\N_ moved successfully.

C:\KomboFix moved successfully.

========== COMMANDS ==========

File delete failed. C:\DOCUME~1\Um\CONFIG~1\Temp\Perflib_Perfdata_9b0.dat scheduled to be deleted on reboot.

File delete failed. C:\DOCUME~1\Um\CONFIG~1\Temp\etilqs_ToZjkLaydaML1Y1 scheduled to be deleted on reboot.

File delete failed. C:\DOCUME~1\Um\CONFIG~1\Temp\etilqs_2Cqet7WKNR3pOaO scheduled to be deleted on reboot.

User's Temp folder emptied.

User's Temporary Internet Files folder emptied.

User's Internet Explorer cache folder emptied.

Local Service Temp folder emptied.

Local Service Temporary Internet Files folder emptied.

File delete failed. C:\windows\temp\Perflib_Perfdata_fc.dat scheduled to be deleted on reboot.

File delete failed. C:\windows\temp\vmware-vmount.log scheduled to be deleted on reboot.

File delete failed. C:\windows\temp\Perflib_Perfdata_d4.dat scheduled to be deleted on reboot.

Windows Temp folder emptied.

Java cache emptied.

FireFox cache emptied.

Temp folders emptied.

OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12152008_202015

Files moved on Reboot...

File C:\DOCUME~1\Um\CONFIG~1\Temp\Perflib_Perfdata_9b0.dat not found!

File C:\DOCUME~1\Um\CONFIG~1\Temp\etilqs_ToZjkLaydaML1Y1 not found!

File C:\DOCUME~1\Um\CONFIG~1\Temp\etilqs_2Cqet7WKNR3pOaO not found!

File C:\windows\temp\Perflib_Perfdata_fc.dat not found!

File move failed. C:\windows\temp\vmware-vmount.log scheduled to be moved on reboot.

C:\windows\temp\Perflib_Perfdata_d4.dat moved successfully.

Logfile of random's system information tool 1.04 (written by random/random)

Run by Um at 2008-12-15 20:24:40

Microsoft Windows XP Professional Service Pack 2

System drive C: has 9 GB (24%) free of 38 GB

Total RAM: 1023 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:24:42, on 15/12/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Normal

Running processes:

C:\windows\System32\smss.exe

C:\windows\system32\winlogon.exe

C:\windows\system32\services.exe

C:\windows\system32\lsass.exe

C:\windows\system32\svchost.exe

C:\windows\System32\svchost.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccSetMgr.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccEvtMgr.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\ARQUIV~1\GbPlugin\GbpSv.exe

C:\windows\system32\spoolsv.exe

C:\Arquivos de programas\Symantec AntiVirus\DefWatch.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\Arquivos de programas\CDBurnerXP\NMSAccessU.exe

C:\windows\system32\nvsvc32.exe

C:\Arquivos de programas\Symantec AntiVirus\Rtvscan.exe

C:\Arquivos de programas\VMware\VMware Workstation\vmware-authd.exe

C:\Arquivos de programas\Arquivos comuns\VMware\VMware Virtual Image Editing\vmount2.exe

C:\WINDOWS\system32\vmnat.exe

C:\WINDOWS\system32\vmnetdhcp.exe

C:\windows\Explorer.EXE

C:\windows\system32\ctfmon.exe

C:\windows\notepad.exe

C:\Arquivos de programas\Analog Devices\Core\smax4pnp.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe

C:\Arquivos de programas\Fábrica de Bits\ACORDA\acorda.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccApp.exe

C:\ARQUIV~1\SYMANT~1\VPTray.exe

C:\Arquivos de programas\Google\Gmail Notifier\gnotify.exe

C:\windows\system32\RUNDLL32.EXE

C:\Arquivos de programas\Java\jre6\bin\jusched.exe

C:\Arquivos de programas\Microsoft Money\System\reminder.exe

C:\Documents and Settings\Um\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe

C:\Arquivos de programas\SpeedFan\speedfan.exe

C:\WINDOWS\explorer.exe

C:\windows\system32\wuauclt.exe