[Arquivado] Windows demorando pra iniciar

Linkmorte · Março 30, 2009

Meu computador ta demorando d+ pra ligar , e pra iniciar os programas [tipo msn] tmb demora um pouquinho... ai quando abre tudo se caso eu abrir o windows media player e colocar alguma musica pra toca e executar alguma açao meio pesada, a musica começa a travar, e antes não acontecia... se alguem puder me ajudar agradeço des de já

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:26:37, on 30/3/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Arquivos de programas\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\ARQUIV~1\AVG\AVG8\avgemc.exe

C:\ARQUIV~1\AVG\AVG8\avgrsx.exe

C:\ARQUIV~1\AVG\AVG8\avgnsx.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

C:\ARQUIV~1\AVG\AVG8\avgtray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

C:\Arquivos de programas\AVG\AVG8\avgcsrvx.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqSTE08.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Arquivos de programas\Windows Live\Messenger\usnsvc.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Hijack\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Arquivos de programas\HP\Smart Web Printing\hpswp_printenhancer.dll

O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Arquivos de programas\HP\Smart Web Printing\hpswp_framework.dll

O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG8\avgssie.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)

O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [HP Software Update] C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARQUIV~1\AVG\AVG8\avgtray.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [cdoosoft] C:\WINDOWS\system32\olhrwef.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: ImTranslator - C:\ARQUIV~1\SMARTL~1\IMTRAN~1\startup.html

O9 - Extra button: Livro de recortes HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Arquivos de programas\HP\Smart Web Printing\hpswp_extensions.dll

O9 - Extra button: Seleção HP Smart - {700259D7-1666-479a-93B1-3250410481E8} - C:\Arquivos de programas\HP\Smart Web Printing\hpswp_extensions.dll

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra button: ImTranslator - {AE436396-55E7-4ec4-AD6D-45E88A530A4C} - C:\ARQUIV~1\SMARTL~1\IMTRAN~1\startup.html (HKCU)

O9 - Extra 'Tools' menuitem: ImTranslator - {AE436396-55E7-4ec4-AD6D-45E88A530A4C} - C:\ARQUIV~1\SMARTL~1\IMTRAN~1\startup.html (HKCU)

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1235792240484

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Arquivos de programas\AVG\AVG8\avgpp.dll

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Arquivos de programas\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Arquivos de programas\TuneUp Utilities 2006\WinStylerThemeSvc.exe

--

MGuitar · Março 30, 2009

- Faça o download do ComboFix e salve-o na área de trabalho;

● Desative temporariamente o seu antivirus para não detectar a ferramenta como vírus;

● Duplo clique no ícone combofix.exe para iniciar o scan;

● Leia o contrato que aparecerá e clique em Sim para continuar;

● Abrirá uma janela do Console de Recuperação, clique em Sim para instalar. Se aparecer outra janela do Console, clique em OK > Sim;

● Aguarde enquanto o ComboFix faz o scan;

● Se ocorrer algum problema durante o scan, reinicie seu computador em Modo de Segurança e repita o procedimento;

● Não clique na janela do ComboFix e procure não utilizar o teclado também, para não atrapalhar a varredura da ferramenta;

● Se quiser sair ou parar o ComboFix, tecle N;

● Quando terminar seu micro será reiniciado. Após o reinicio, a ferramenta executará novamente, aguarde;

● Será gerado um log em C:\ComboFix.txt.

Cole este log em sua próxima resposta.

Linkmorte · Março 31, 2009

ComboFix 09-03-30.04 - Andy 2009-03-31 13:11:59.3 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.511.237 [GMT -3:00]

Executando de: c:\documents and settings\Andy\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning enabled* (Outdated)

* Criado um novo ponto de restauro

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Andy\Dados de aplicativos\inst.exe

C:\minm.cmd

c:\windows\system32\AVSredirect.dll

D:\em8tqm.cmd

D:\minm.cmd

.

---- -------

.

C:\autorun.inf

c:\windows\system32\olhrwef.exe

D:\Autorun.inf

.

(((((((((((((((( Arquivos/Ficheiros criados de 2009-02-28 to 2009-03-31 ))))))))))))))))))))))))))))

.

2009-04-28 20:00 . 2009-04-28 20:01 <DIR> d-------- c:\documents and settings\Andy\Dados de aplicativos\Tibia

2009-04-28 19:59 . 2009-04-28 19:59 <DIR> d-------- c:\arquivos de programas\Tibia

2009-04-28 18:29 . 2009-04-28 18:28 110,067 -r-hs---- C:\0bcobed.exe

2009-04-28 17:06 . 2009-04-28 17:08 <DIR> d-------- C:\Soldat

2009-04-28 16:23 . 2009-03-31 12:32 294 --a------ c:\windows\elif98.ini

2009-04-28 16:23 . 2009-04-28 16:23 34 --a------ c:\windows\eli.cod

2009-03-30 20:07 . 2009-03-30 20:07 0 -ra------ C:\logwmemory.bin

2009-03-30 18:42 . 2009-03-31 12:37 <DIR> d-------- C:\Cd

2009-03-26 02:04 . 2009-03-26 02:15 <DIR> d-------- C:\De volta

2009-03-23 01:00 . 2009-03-23 01:00 <DIR> d-------- C:\Program Files

2009-03-23 01:00 . 2004-02-22 10:11 719,872 --a------ c:\windows\system32\devil.dll

2009-03-23 01:00 . 2007-05-17 17:30 318,976 --a------ c:\windows\system32\avisynth.dll

2009-03-23 01:00 . 2004-01-25 00:00 70,656 --a------ c:\windows\system32\i420vfw.dll

2009-03-23 00:58 . 2009-03-23 00:58 <DIR> d-------- c:\arquivos de programas\eRightSoft

2009-03-20 17:42 . 2007-09-12 21:43 2,277,376 --a------ c:\arquivos de programas\Apecsoft RMVB WMV to AVI Converter.exe

2009-03-18 14:32 . 2009-03-18 14:32 <DIR> d-------- c:\arquivos de programas\WinAVI Video Converter

2009-03-18 14:30 . 2009-03-20 18:05 <DIR> d-------- c:\documents and settings\Andy\Dados de aplicativos\Vso

2009-03-18 14:30 . 2009-03-18 14:30 <DIR> d-------- c:\arquivos de programas\VSO

2009-03-18 14:30 . 2006-05-20 16:16 1,184,984 --a------ c:\windows\system32\wvc1dmod.dll

2009-03-18 14:30 . 2006-05-11 19:21 626,688 --a------ c:\windows\system32\vp7vfw.dll

2009-03-18 14:30 . 2006-09-29 12:24 217,127 --a------ c:\windows\system32\drv43260.dll

2009-03-18 14:30 . 2006-09-29 12:25 208,935 --a------ c:\windows\system32\drv33260.dll

2009-03-18 14:30 . 2006-09-29 12:26 176,165 --a------ c:\windows\system32\drv23260.dll

2009-03-18 14:30 . 2002-12-10 02:20 102,439 --a------ c:\windows\system32\sipr3260.dll

2009-03-18 14:30 . 2007-03-18 20:37 65,602 --a------ c:\windows\system32\cook3260.dll

2009-03-18 14:30 . 2009-03-18 14:30 47,360 --a------ c:\windows\system32\drivers\pcouffin.sys

2009-03-18 14:30 . 2009-03-18 14:30 47,360 --a------ c:\documents and settings\Andy\Dados de aplicativos\pcouffin.sys

2009-03-18 10:53 . 2009-03-30 19:23 116 --a------ c:\windows\NeroDigital.ini

2009-03-17 23:46 . 2009-03-20 17:41 <DIR> d-a------ c:\documents and settings\All Users\Dados de aplicativos\TEMP

2009-03-17 23:46 . 2009-03-29 22:20 <DIR> d-------- c:\arquivos de programas\ApecSoft

2009-03-17 22:57 . 2009-03-17 22:57 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\Nero

2009-03-17 22:56 . 2000-06-26 11:45 106,496 --a------ c:\windows\system32\TwnLib20.dll

2009-03-17 22:55 . 2009-03-17 22:55 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\Ahead

2009-03-17 22:55 . 2009-03-17 22:56 <DIR> d-------- c:\arquivos de programas\Ahead

2009-03-17 22:55 . 2004-07-26 17:16 1,568,768 --------- c:\windows\system32\ImagX7.dll

2009-03-17 22:55 . 2004-07-26 17:16 476,320 --------- c:\windows\system32\ImagXpr7.dll

2009-03-17 22:55 . 2004-07-26 17:16 471,040 --------- c:\windows\system32\ImagXRA7.dll

2009-03-17 22:55 . 2004-07-26 17:16 262,144 --------- c:\windows\system32\ImagXR7.dll

2009-03-17 22:55 . 2001-07-09 11:50 155,648 --a------ c:\windows\system32\NeroCheck.exe

2009-03-15 21:56 . 2004-08-04 00:45 91,136 --a------ c:\windows\system32\kswdmcap.ax

2009-03-15 21:52 . 2009-03-15 21:52 <DIR> d-------- c:\arquivos de programas\Digital Camera

2009-03-15 21:52 . 2007-02-26 21:28 55,808 --a------ c:\windows\system32\drivers\nvtcam.sys

2009-03-15 21:52 . 2004-04-12 14:32 41,760 --a------ c:\windows\system\VFWWDM.DRV

2009-03-15 21:52 . 2007-02-26 21:28 24,192 --a------ c:\windows\system32\drivers\NVTCAMD2.SYS

2009-03-15 15:53 . 2009-03-15 15:53 <DIR> d-------- c:\arquivos de programas\Red Eye Remover Pro

2009-03-15 15:52 . 2009-03-15 15:54 <DIR> d-------- c:\arquivos de programas\RedEye

2009-03-13 00:38 . 2009-03-13 00:38 <DIR> d--h----- c:\windows\PIF

2009-03-10 14:09 . 2009-04-28 15:17 <DIR> d-------- c:\documents and settings\Andy\Dados de aplicativos\uTorrent

2009-03-10 14:09 . 2009-03-10 14:09 <DIR> d-------- c:\arquivos de programas\uTorrent

2009-03-02 01:12 . 2009-03-02 01:12 244 --ah----- C:\sqmnoopt19.sqm

2009-03-02 01:12 . 2009-03-02 01:12 232 --ah----- C:\sqmdata19.sqm

2009-03-02 01:08 . 2009-03-02 01:08 244 --ah----- C:\sqmnoopt18.sqm

2009-03-02 01:08 . 2009-03-02 01:08 232 --ah----- C:\sqmdata18.sqm

2009-03-02 01:04 . 2009-03-02 01:04 244 --ah----- C:\sqmnoopt17.sqm

2009-03-02 01:04 . 2009-03-02 01:04 232 --ah----- C:\sqmdata17.sqm

2009-03-02 00:56 . 2009-03-02 00:56 244 --ah----- C:\sqmnoopt16.sqm

2009-03-02 00:56 . 2009-03-02 00:56 232 --ah----- C:\sqmdata16.sqm

2009-03-02 00:52 . 2009-03-02 00:52 244 --ah----- C:\sqmnoopt15.sqm

2009-03-02 00:52 . 2009-03-02 00:52 232 --ah----- C:\sqmdata15.sqm

2009-03-02 00:51 . 2009-03-02 00:51 244 --ah----- C:\sqmnoopt14.sqm

2009-03-02 00:51 . 2009-03-02 00:51 232 --ah----- C:\sqmdata14.sqm

2009-03-02 00:30 . 2009-03-02 02:09 244 --ah----- C:\sqmnoopt13.sqm

2009-03-02 00:30 . 2009-03-02 02:09 232 --ah----- C:\sqmdata13.sqm

2009-03-02 00:26 . 2009-03-02 02:04 244 --ah----- C:\sqmnoopt12.sqm

2009-03-02 00:26 . 2009-03-02 02:04 232 --ah----- C:\sqmdata12.sqm

2009-03-02 00:12 . 2009-03-02 01:59 244 --ah----- C:\sqmnoopt11.sqm

2009-03-02 00:12 . 2009-03-02 01:59 232 --ah----- C:\sqmdata11.sqm

2009-03-02 00:05 . 2009-03-02 01:58 244 --ah----- C:\sqmnoopt10.sqm

2009-03-02 00:05 . 2009-03-02 01:58 232 --ah----- C:\sqmdata10.sqm

2009-03-01 21:23 . 2009-03-02 01:57 244 --ah----- C:\sqmnoopt09.sqm

2009-03-01 21:23 . 2009-03-02 01:49 244 --ah----- C:\sqmnoopt08.sqm

2009-03-01 21:23 . 2009-03-02 01:57 232 --ah----- C:\sqmdata09.sqm

2009-03-01 21:23 . 2009-03-02 01:49 232 --ah----- C:\sqmdata08.sqm

2009-03-01 21:22 . 2009-03-02 01:49 244 --ah----- C:\sqmnoopt07.sqm

2009-03-01 21:22 . 2009-03-02 01:44 244 --ah----- C:\sqmnoopt06.sqm

2009-03-01 21:22 . 2009-03-02 01:31 244 --ah----- C:\sqmnoopt05.sqm

2009-03-01 21:22 . 2009-03-02 01:49 232 --ah----- C:\sqmdata07.sqm

2009-03-01 21:22 . 2009-03-02 01:44 232 --ah----- C:\sqmdata06.sqm

2009-03-01 21:22 . 2009-03-02 01:31 232 --ah----- C:\sqmdata05.sqm

2009-03-01 21:21 . 2009-03-02 01:30 244 --ah----- C:\sqmnoopt04.sqm

2009-03-01 21:21 . 2009-03-02 01:26 244 --ah----- C:\sqmnoopt03.sqm

2009-03-01 21:21 . 2009-03-02 01:30 232 --ah----- C:\sqmdata04.sqm

2009-03-01 21:21 . 2009-03-02 01:26 232 --ah----- C:\sqmdata03.sqm

2009-03-01 21:16 . 2009-03-30 18:24 <DIR> d-------- C:\Hijack

2009-03-01 20:53 . 2009-03-02 01:23 244 --ah----- C:\sqmnoopt02.sqm

2009-03-01 20:53 . 2009-03-02 01:23 232 --ah----- C:\sqmdata02.sqm

2009-02-28 13:35 . 2009-03-31 09:31 <DIR> d--h----- C:\$AVG8.VAULT$

2009-02-28 03:39 . 2009-03-08 22:17 <DIR> d-------- c:\windows\Baterry

2009-02-28 03:34 . 2009-03-29 21:56 <DIR> d-------- c:\windows\system32\drivers\Avg

2009-02-28 03:34 . 2009-03-31 12:44 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\avg8

2009-02-28 03:34 . 2009-02-28 03:34 <DIR> d-------- c:\arquivos de programas\AVG

2009-02-28 03:34 . 2009-03-29 21:56 325,640 --a------ c:\windows\system32\drivers\avgldx86.sys

2009-02-28 03:34 . 2009-03-29 21:55 107,912 --a------ c:\windows\system32\drivers\avgtdix.sys

2009-02-28 03:34 . 2009-03-29 21:56 10,520 --a------ c:\windows\system32\avgrsstx.dll

2009-02-28 03:31 . 2009-02-28 03:31 <DIR> d-------- c:\arquivos de programas\Ares

2009-02-28 03:17 . 2009-02-28 03:17 <DIR> d-------- c:\documents and settings\Andy\Dados de aplicativos\Media Player Classic

2009-02-28 02:35 . 2009-02-28 02:35 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\WEBREG

2009-02-28 02:33 . 2009-02-28 02:33 <DIR> d-------- c:\documents and settings\Andy\Dados de aplicativos\HPAppData

2009-02-28 02:33 . 2009-02-28 02:33 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\HPSSUPPLY

2009-02-28 02:32 . 2009-02-28 02:32 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\HP Product Assistant

2009-02-28 02:32 . 2009-02-28 02:32 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\HP

2009-02-28 02:31 . 2009-02-28 02:31 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\HP

2009-02-28 02:30 . 2009-02-28 02:30 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\Hewlett-Packard

2009-02-28 02:30 . 2007-03-30 12:11 267,864 -ra------ c:\windows\system32\hpzids01.dll

2009-02-28 02:30 . 2007-03-28 14:01 117,760 --a------ c:\windows\system32\hpzll5ha.dll

2009-02-28 02:29 . 2009-02-28 02:33 <DIR> d-------- c:\arquivos de programas\HP

2009-02-28 02:29 . 2004-08-03 23:08 31,616 --a------ c:\windows\system32\drivers\usbccgp.sys

2009-02-28 02:29 . 2004-08-03 23:08 31,616 --a--c--- c:\windows\system32\dllcache\usbccgp.sys

2009-02-28 02:28 . 2009-02-28 02:35 148,121 --a------ c:\windows\HPHins15.dat

2009-02-28 02:28 . 2007-08-28 03:45 2,828 --------- c:\windows\hphmdl15.dat

2009-02-28 02:24 . 2009-02-28 02:24 1,204 --a------ c:\windows\mozver.dat

2009-02-28 02:19 . 2003-06-19 01:31 17,920 --a------ c:\windows\system32\mdimon.dll

2009-02-28 02:19 . 2009-02-28 02:19 421 --a------ c:\windows\ODBC.INI

2009-02-28 02:18 . 2009-02-28 02:18 <DIR> d-------- c:\windows\SHELLNEW

2009-02-28 02:16 . 2004-08-03 23:01 25,856 --a------ c:\windows\system32\drivers\usbprint.sys

2009-02-28 02:16 . 2004-08-03 23:01 25,856 --a--c--- c:\windows\system32\dllcache\usbprint.sys

2009-02-28 02:11 . 2009-02-28 02:11 <DIR> dr-h----- C:\MSOCache

2009-02-28 01:47 . 2009-03-07 12:11 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\Messenger Plus!

2009-02-28 01:35 . 2009-02-28 01:35 <DIR> d-------- c:\arquivos de programas\Messenger Plus! Live

2009-02-28 01:35 . 2009-03-02 01:19 244 --ah----- C:\sqmnoopt01.sqm

2009-02-28 01:35 . 2009-03-02 01:19 232 --ah----- C:\sqmdata01.sqm

2009-02-28 01:34 . 2009-03-02 01:17 244 --ah----- C:\sqmnoopt00.sqm

2009-02-28 01:34 . 2009-03-02 01:17 232 --ah----- C:\sqmdata00.sqm

2009-02-28 01:20 . 2009-03-26 21:12 <DIR> d-------- c:\documents and settings\Andy\Contacts

2009-02-28 01:11 . 2009-02-28 02:30 <DIR> d----c--- c:\windows\system32\DRVSTORE

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-28 01:37 --------- d-----w c:\arquivos de programas\microsoft frontpage

2009-02-28 01:34 --------- d-----w c:\arquivos de programas\Serviços on-line

2009-02-28 01:33 --------- d-----w c:\arquivos de programas\Arquivos comuns\Serviços

2006-05-03 10:06 163,328 --sh--r c:\windows\system32\flvDX.dll

2007-02-21 11:47 31,232 --sh--r c:\windows\system32\msfDX.dll

2008-03-16 13:30 216,064 --sh--r c:\windows\system32\nbDX.dll

.

((((((((((((((((((((((((((((( SnapShot@2009-03-02_14.39.09.10 )))))))))))))))))))))))))))))))))))))))))

.

+ 2004-08-04 02:10:18 17,024 -c--a-w c:\windows\system32\dllcache\ccdecode.sys

+ 2004-08-04 01:58:40 5,504 -c--a-w c:\windows\system32\dllcache\mstee.sys

+ 2004-08-04 02:10:30 85,376 -c--a-w c:\windows\system32\dllcache\nabtsfec.sys

+ 2004-08-04 02:10:14 10,880 -c--a-w c:\windows\system32\dllcache\ndisip.sys

+ 2004-08-04 02:10:18 11,136 -c--a-w c:\windows\system32\dllcache\slip.sys

+ 2004-08-04 02:10:14 15,360 -c--a-w c:\windows\system32\dllcache\streamip.sys

+ 2004-08-04 02:08:38 26,624 -c--a-w c:\windows\system32\dllcache\usbehci.sys

+ 2004-08-04 02:10:12 78,464 -c--a-w c:\windows\system32\dllcache\usbvideo.sys

+ 2004-08-04 03:45:28 54,784 -c--a-w c:\windows\system32\dllcache\vfwwdm32.dll

+ 2004-08-04 02:10:22 19,328 -c--a-w c:\windows\system32\dllcache\wstcodec.sys

+ 2004-08-04 02:10:18 17,024 ----a-w c:\windows\system32\drivers\CCDECODE.sys

+ 2004-08-04 01:58:40 5,504 ----a-w c:\windows\system32\drivers\MSTEE.sys

+ 2004-08-04 02:10:30 85,376 ----a-w c:\windows\system32\drivers\NABTSFEC.sys

+ 2004-08-04 02:10:14 10,880 ----a-w c:\windows\system32\drivers\NdisIP.sys

+ 2004-08-04 02:10:18 11,136 ----a-w c:\windows\system32\drivers\SLIP.sys

+ 2004-08-04 02:10:14 15,360 ----a-w c:\windows\system32\drivers\StreamIP.sys

+ 2004-08-04 02:10:12 78,464 ----a-w c:\windows\system32\drivers\usbvideo.sys

+ 2004-08-04 02:10:22 19,328 ----a-w c:\windows\system32\drivers\WSTCODEC.SYS

- 2009-02-28 06:13:09 111,784 ----a-w c:\windows\system32\FNTCACHE.DAT

+ 2009-03-18 23:47:54 402,328 ----a-w c:\windows\system32\FNTCACHE.DAT

+ 2004-08-04 03:45:28 54,784 ----a-w c:\windows\system32\vfwwdm32.dll

- 2004-01-25 21:18:44 217,088 ----a-w c:\windows\system32\yv12vfw.dll

+ 2004-01-25 03:00:00 70,656 ----a-w c:\windows\system32\yv12vfw.dll

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

"MsnMsgr"="c:\arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

"MSMSGS"="c:\arquivos de programas\Messenger\msmsgs.exe" [2004-08-04 1667584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Adobe Reader Speed Launcher"="c:\arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-29 8466432]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-29 81920]

"HP Software Update"="c:\arquivos de programas\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"AVG8_TRAY"="c:\arquiv~1\AVG\AVG8\avgtray.exe" [2009-03-29 1932568]

"SoundMan"="SOUNDMAN.EXE" [2005-11-11 c:\windows\soundman.exe]

"nwiz"="nwiz.exe" [2007-06-29 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

"msnmsgr"="c:\arquivos de programas\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]

c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\

HP Digital Imaging Monitor.lnk - c:\arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2009-03-29 21:56 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.I420"= i420vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"=

"c:\\Arquivos de programas\\Mozilla Firefox\\firefox.exe"=

"c:\\Arquivos de programas\\uTorrent\\uTorrent.exe"=

"c:\\Arquivos de programas\\AVG\\AVG8\\avgemc.exe"=

"c:\\Arquivos de programas\\AVG\\AVG8\\avgnsx.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-02-28 325640]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-02-28 107912]

R2 avg8emc;AVG Free8 E-mail Scanner;c:\arquiv~1\AVG\AVG8\avgemc.exe [2009-03-29 908056]

R2 avg8wd;AVG Free8 WatchDog;c:\arquiv~1\AVG\AVG8\avgwdsvc.exe [2009-03-29 298264]

S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{30a463d2-0c27-11de-bfa9-0013d3c07505}]

\Shell\AutoRun\command - G:\em8tqm.cmd

\Shell\open\Command - G:\em8tqm.cmd

.

Conteúdo da pasta 'Tarefas Agendadas'

2009-03-27 c:\windows\Tasks\1-Click Maintenance.job

- c:\arquivos de programas\TuneUp Utilities 2006\SystemOptimizer.exe [2005-09-21 22:35]

.

- - - - ORFÃOS REMOVIDOS - - - -

HKCU-Run-cdoosoft - c:\windows\system32\olhrwef.exe

.

------- Scan Suplementar -------

.

uStart Page = hxxp://www.sonico.com/

uInternet Connection Wizard,ShellNext = iexplore

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: ImTranslator - c:\arquiv~1\SMARTL~1\IMTRAN~1\startup.html

FF - ProfilePath - c:\documents and settings\Andy\Dados de aplicativos\Mozilla\Firefox\Profiles\8ay8qa48.default\

FF - component: c:\arquivos de programas\AVG\AVG8\Firefox\components\avgssff.dll

FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

---- FIREFOX POLICIES ----

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-03-31 13:15:05

Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

.

Tempo para conclusão: 2009-03-31 13:17:43

ComboFix-quarantined-files.txt 2009-03-31 16:17:20

Pré-execução: 18 pasta(s) 108,325,556,224 bytes disponíveis

Pós execução: 17 pasta(s) 108,315,701,248 bytes disponíveis

269

MGuitar · Abril 1, 2009

Baixe o PureRa e extraia o arquivo para o desktop:

Execute o programa e clique em Clean. Ao lado direito marque apenas as opções: *.sqm e Desktop.ini.

Clique no botão Clean Selected.

Selecione e copie o conteúdo abaixo. Cole-o no Bloco de Notas e salve-o no desktop como CFScript.txt

File::
C:\0bcobed.exe

G:\em8tqm.cmd

Registry::

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{30a463d2-0c27-11de-bfa9-0013d3c07505}]

Arraste o CFScript para o ComboFix como na imagem aqui abaixo e aguarde a execução automática da ferramenta:

● Se for solicitado à você, pressione Enter para iniciar o processo de remoção;

● Não use o mouse nem o teclado quando o ComboFix estiver rodando;

● Quando terminar, será gerado um novo log que estará em C:\ComboFix.txt;

● Talvez seu computador seja reiniciado automaticamente. Caso não ocorra, reinicie-o manualmente.

Na sua próxima resposta, cole o ComboFix.txt e um novo log do HijackThis.

Linkmorte · Abril 1, 2009

Aqui

ComboFix 09-03-30.04 - Andy 2009-04-01 14:17:31.4 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.511.284 [GMT -3:00]

Executando de: c:\documents and settings\Andy\Desktop\ComboFix.exe

Comandos utilizados :: c:\documents and settings\Andy\Desktop\CFScript.txt

AV: AVG Anti-Virus Free *On-access scanning enabled* (Outdated)

* Criado um novo ponto de restauro

FILE ::

C:\0bcobed.exe

G:\em8tqm.cmd

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\0bcobed.exe

.

(((((((((((((((( Arquivos/Ficheiros criados de 2009-03-01 to 2009-04-01 ))))))))))))))))))))))))))))

.

2009-04-28 20:00 . 2009-04-28 20:01 <DIR> d-------- c:\documents and settings\Andy\Dados de aplicativos\Tibia

2009-04-28 19:59 . 2009-04-28 19:59 <DIR> d-------- c:\arquivos de programas\Tibia

2009-04-28 17:06 . 2009-04-28 17:08 <DIR> d-------- C:\Soldat

2009-04-28 16:23 . 2009-03-31 23:34 297 --a------ c:\windows\elif98.ini