[Resolvido!] Computador Travando / Explorer Travando

BabiFerrer · Junho 4, 2009

Boa tarde,

Mais uma vez pedindo a ajuda de vcs para resolver um problemão !

Meu Explorer esta travando toda hora, trava e a tela fica toda azul, tenho que reiniciar o computador ao menos 3 a 4 vezes por dia.

Por favor me ajudem !

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 13:55, on 04/06/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16827)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\ARQUIV~1\GbPlugin\GbpSv.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\Arquivos de programas\SafeNet\BSecClient\axmonitor.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\aetcrss1.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\SCardSvr.exe

C:\WINDOWS\system32\dklog.exe

C:\WINDOWS\system32\dkvcm.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\dkcktkn.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\PDFCreator\PDFCreator.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\Documents and Settings\Administrador.OEM\Desktop\HiJackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uol.com.br/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://orion/

O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre6\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\ARQUIVOS DE PROGRAMAS\GBPLUGIN\gbieh.dll

O2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\Arquivos de programas\GbPlugin\gbiehcef.dll

O2 - BHO: G-Buster Browser Defense ABN AMRO - {C41A1C0E-EA6C-11D4-B1B8-444553540007} - C:\ARQUIV~1\GbPlugin\gbiehabn.dll

O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Arquivos de programas\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Arquivos de programas\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Arquivos de programas\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar.dll

O4 - HKLM\..\Run: [AxMonitor] C:\Arquivos de programas\SafeNet\BSecClient\axmonitor.exe

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [CertificateRegistration] aetcrss1.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {3B2FC559-5102-4482-9684-66906D53A500} (Auth Class) - http://www.t37.com.br/_conteudo/ecpf/EvalCriptoCOM.cab

O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com.br/s/v/35.08/uploader2.cab

O16 - DPF: {8569D715-FF88-44BA-8D1D-AD3E59543DDE} (ActiveReports Viewer2) - http://www.wilsononline.com.br/includes/asp/arview2.cab

O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game02.zylom.com/activex/zylomgamesplayer.cab

O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399007} (GbPluginObj Class) - https://wwws.realsecureweb.com.br/mpr/plugi...GbPluginABN.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{C327EC23-7F81-4E1D-802C-8780052BCD50}: NameServer = 200.204.0.10 200.204.0.138

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)

O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Arquivos de programas\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: SafeNet Log Service (DkLogger) - SafeNet, Inc. - C:\WINDOWS\system32\dklog.exe

O23 - Service: SafeNet Token Service (DkTknSrv) - SafeNet, Inc. - C:\WINDOWS\system32\dkcktkn.exe

O23 - Service: SafeNet Virtual Channel Monitor (DkVcm) - SafeNet, Inc. - C:\WINDOWS\system32\dkvcm.exe

O23 - Service: Gbp Service (GbpSv) - - C:\ARQUIV~1\GbPlugin\GbpSv.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe

O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--

End of file - 8697 bytes

------------------

Incluindo Log do Combofix

ComboFix 09-06-03.04 - Administrador 04/06/2009 14:05.7 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1046.18.958.534 [GMT -3:00]

Executando de: c:\documents and settings\Administrador.OEM\Desktop\ComboFix.exe

AV: avast! antivirus 4.8.1335 [VPS 090603-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

ADS - drivers: deleted 350 bytes in 1 streams.

(((((((((((((((( Arquivos/Ficheiros criados de 2009-05-04 to 2009-06-04 ))))))))))))))))))))))))))))

.

2009-05-27 17:12 . 2009-05-27 17:12 7680 -c--a-w- c:\documents and settings\Administrador.OEM\Dados de aplicativos\LimeWire\browser\xulrunner\components\xulutil.dll

2009-05-26 16:51 . 2005-10-15 15:32 196608 -c--a-w- c:\windows\system32\pdfcmnnt.dll

2009-05-26 16:51 . 1998-07-06 03:00 23552 -c--a-w- c:\windows\system32\MSMPIDE.DLL

2009-05-26 16:51 . 2009-05-26 16:57 -------- dc----w- c:\arquivos de programas\PDFCreator

2009-05-22 16:09 . 2009-05-08 14:46 38208 -c--a-w- c:\documents and settings\Administrador.OEM\Dados de aplicativos\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

2009-05-08 14:48 . 2009-05-08 14:48 -------- dc----w- c:\documents and settings\Administrador.OEM\Dados de aplicativos\TweetDeckFast.F9107117265DB7542C1A806C8DB837742CE14C21.1

2009-05-08 14:47 . 2009-05-08 14:47 -------- dc----w- c:\arquivos de programas\TweetDeck

2009-05-08 14:47 . 2009-05-08 14:47 -------- dc----w- c:\arquivos de programas\Arquivos comuns\Adobe AIR

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-05-29 20:06 . 2009-05-27 17:12 -------- dc----w- c:\documents and settings\Administrador.OEM\Dados de aplicativos\LimeWire

2009-05-29 20:00 . 2009-02-02 13:20 -------- dc----w- c:\arquivos de programas\Malwarebytes' Anti-Malware

2009-05-29 20:00 . 2009-03-13 18:00 3371383 -c--a-w- c:\documents and settings\All Users.WINDOWS\Dados de aplicativos\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2009-05-27 17:12 . 2009-05-27 17:12 282624 -c--a-w- c:\documents and settings\Administrador.OEM\Dados de aplicativos\LimeWire\browser\xulrunner\components\websrvcs.dll

2009-05-27 17:12 . 2009-05-27 17:12 15872 -c--a-w- c:\documents and settings\Administrador.OEM\Dados de aplicativos\LimeWire\browser\xulrunner\components\xmlextras.dll

2009-05-27 17:12 . 2009-05-27 17:12 200704 -c--a-w- c:\documents and settings\Administrador.OEM\Dados de aplicativos\LimeWire\browser\xulrunner\components\transformiix.dll

2009-05-27 17:12 . 2009-05-27 17:12 110592 -c--a-w- c:\documents and settings\Administrador.OEM\Dados de aplicativos\LimeWire\browser\xulrunner\components\universalchardet.dll

2009-05-27 17:12 . 2009-05-27 17:12 225280 -c--a-w- c:\documents and settings\Administrador.OEM\Dados de aplicativos\LimeWire\browser\xulrunner\components\pipnss.dll

2009-05-27 17:12 . 2009-05-27 17:12 20992 -c--a-w- c:\documents and settings\Administrador.OEM\Dados de aplicativos\LimeWire\browser\xulrunner\components\pipboot.dll

2009-05-27 17:12 . 2009-05-27 17:12 19968 -c--a-w- c:\documents and settings\Administrador.OEM\Dados de aplicativos\LimeWire\browser\xulrunner\components\pippki.dll

2009-05-27 17:12 . 2009-05-27 17:12 20480 -c--a-w- c:\documents and settings\Administrador.OEM\Dados de aplicativos\LimeWire\browser\xulrunner\components\autoconfig.dll

2009-05-27 17:12 . 2009-05-27 17:12 18944 -c--a-w- c:\documents and settings\Administrador.OEM\Dados de aplicativos\LimeWire\browser\xulrunner\components\appshell_modal.dll

2009-05-27 17:12 . 2009-05-27 17:12 17408 -c--a-w- c:\documents and settings\Administrador.OEM\Dados de aplicativos\LimeWire\browser\xulrunner\components\auth.dll

2009-05-27 17:12 . 2009-05-27 17:12 8192 -c--a-w- c:\documents and settings\Administrador.OEM\Dados de aplicativos\LimeWire\browser\xulrunner\AccessibleMarshal.dll

2009-05-27 17:12 . 2009-05-27 17:12 20480 -c--a-w- c:\documents and settings\Administrador.OEM\Dados de aplicativos\LimeWire\browser\xulrunner\IA2Marshal.dll

2009-05-27 17:12 . 2009-05-27 17:10 -------- dc----w- c:\arquivos de programas\LimeWire

2009-05-26 16:20 . 2009-02-02 13:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-05-26 16:19 . 2009-02-02 13:20 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-05-26 13:16 . 2006-09-20 17:37 -------- dc----w- c:\arquivos de programas\Arquivos comuns\Adobe

2009-05-22 10:57 . 2009-02-19 13:48 -------- dc----w- c:\documents and settings\All Users.WINDOWS\Dados de aplicativos\GbPlugin

2009-05-22 10:57 . 2008-07-08 17:53 -------- dc----w- c:\arquivos de programas\GbPlugin

2009-05-12 19:52 . 2007-04-01 18:41 -------- dc----w- c:\documents and settings\All Users.WINDOWS\Dados de aplicativos\Spybot - Search & Destroy

2009-05-01 18:30 . 2009-05-01 18:30 3366912 -c--a-w- c:\windows\system32\GPhotos.scr

2009-04-27 18:48 . 2008-12-18 13:24 47956 -c-ha-w- c:\windows\system32\mlfcache.dat

2009-04-22 20:09 . 2007-09-11 20:26 -------- dc----w- c:\arquivos de programas\Spybot - Search & Destroy

2009-04-17 11:09 . 2001-10-28 15:07 49586 ----a-w- c:\windows\system32\perfc016.dat

2009-04-17 11:09 . 2001-10-28 15:07 347294 ----a-w- c:\windows\system32\perfh016.dat

2009-03-27 15:03 . 2009-02-03 13:25 26568 ----a-w- c:\windows\system32\drivers\gbpkm.sys

2009-03-26 10:56 . 2009-03-20 15:31 81920 -c--a-w- c:\documents and settings\Administrador.OEM\Dados de aplicativos\zweitgeist\uninstall.exe

2009-03-20 15:31 . 2009-03-20 15:31 49152 -c--a-w- c:\documents and settings\Administrador.OEM\Dados de aplicativos\zweitgeist\IdleHook.dll

2009-03-20 15:31 . 2009-03-20 15:31 20480 -c--a-w- c:\documents and settings\Administrador.OEM\Dados de aplicativos\zweitgeist\hook13.dll

2008-03-19 19:34 . 2008-03-19 19:34 14298 -c--a-w- c:\arquivos de programas\settings.dat

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AxMonitor"="c:\arquivos de programas\SafeNet\BSecClient\axmonitor.exe" [2007-09-13 450560]

"avast!"="c:\arquiv~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-31 7634944]

"CertificateRegistration"="aetcrss1.exe" - c:\windows\system32\aetcrss1.exe [2008-03-12 208896]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{E37CB5F0-51F5-4395-A808-5FA49E399007}"= "c:\arquiv~1\GbPlugin\gbiehabn.dll" [2008-09-26 378792]

"{E37CB5F0-51F5-4395-A808-5FA49E399003}"= "c:\arquivos de programas\GbPlugin\gbiehcef.dll" [2009-03-27 264776]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Iniciar^Programas^Inicializar^PDFCreator.lnk]

path=c:\documents and settings\All Users.WINDOWS\Menu Iniciar\Programas\Inicializar\PDFCreator.lnk

backup=c:\windows\pss\PDFCreator.lnkCommon Startup

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"ctfmon.exe"=c:\windows\system32\ctfmon.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\Messenger\\msmsgs.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Arquivos de programas\\MSN Messenger\\msnmsgr.exe"=

"c:\\Arquivos de programas\\MSN Messenger\\livecall.exe"=

R0 GbpKm;Gbp KernelMode;c:\windows\system32\drivers\gbpkm.sys [03/02/2009 10:25 26568]

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [03/02/2009 13:33 114768]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [03/02/2009 13:33 20560]

R2 DkVcm;SafeNet Virtual Channel Monitor;c:\windows\system32\dkvcm.exe [13/09/2007 14:21 122880]

R2 GbpSv;Gbp Service;c:\arquiv~1\GbPlugin\GbpSv.exe [08/07/2008 14:53 52808]

R3 iKeyEnum;Rainbow iKey Enumerator;c:\windows\system32\drivers\IKEYENUM.SYS [07/08/2008 16:38 12480]

R3 iKeyIFD;Rainbow iKey Virtual Reader;c:\windows\system32\drivers\IKEYIFD.SYS [07/08/2008 16:38 19232]

R3 PERTO38U;PertoSmart EMV - Leitor USB de Cartoes Inteligentes;c:\windows\system32\drivers\perto38u.sys [10/10/2006 14:06 33408]

S3 RnbToken;Rainbow iKey Token Service;c:\windows\system32\drivers\RNBTOKEN.SYS [07/08/2008 16:38 22304]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\aetsprov]

c:\windows\system32\regsvr32.exe /s c:\windows\system32\aetsprov.dll

.

Conteúdo da pasta 'Tarefas Agendadas'

2009-04-15 c:\windows\Tasks\User_Feed_Synchronization-{22B879E5-9FF6-41BF-A137-EE1116761378}.job

- c:\windows\system32\msfeedssync.exe [2007-08-13 21:36]

2009-03-26 c:\windows\Tasks\WGASetup.job

- c:\windows\system32\KB905474\wgasetup.exe [2009-03-26 01:18]

.

- - - - ORFÃOS REMOVIDOS - - - -

SafeBoot-procexp90.Sys

.

------- Scan Suplementar -------

.

uStart Page = hxxp://www.uol.com.br/

uInternet Connection Wizard,ShellNext = hxxp://orion/

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

TCP: {C327EC23-7F81-4E1D-802C-8780052BCD50} = 200.204.0.10 200.204.0.138

Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\arquivos de programas\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

DPF: {3B2FC559-5102-4482-9684-66906D53A500} - hxxp://www.t37.com.br/_conteudo/ecpf/EvalCriptoCOM.cab

DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game02.zylom.com/activex/zylomgamesplayer.cab

DPF: {E37CB5F0-51F5-4395-A808-5FA49E399007} - hxxps://wwws.realsecureweb.com.br/mpr/plugin/Cab/GbPluginABN.cab

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-06-04 14:10

Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ...

c:\windows\system32\zshp1018.exe [2872] 0x85DCE610

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-507921405-2000478354-725345543-500\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (Administrator)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,3c,be,5c,73,dc,69,f1,4c,9a,9e,6e,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,3c,be,5c,73,dc,69,f1,4c,9a,9e,6e,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540000}\Programmable]

@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E37CB5F0-51F5-4395-A808-5FA49E399003}\Programmable]

@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E37CB5F0-51F5-4395-A808-5FA49E399F83}\Programmable]

@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy]

@DACL=(02 0000)

"Asynchronous"=dword:00000001

"DllName"=expand:"%SystemRoot%\\System32\\dimsntfy.dll"

"Startup"="WlDimsStartup"

"Shutdown"="WlDimsShutdown"

"Logon"="WlDimsLogon"

"Logoff"="WlDimsLogoff"

"StartShell"="WlDimsStartShell"

"Lock"="WlDimsLock"

"Unlock"="WlDimsUnlock"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\DkWLNP]

@DACL=(02 0000)

"DllName"=expand:"DkWLNP.dll"

"Logon"="WLEventLogon"

"Logoff"="WLEventLogoff"

"StartShell"="WLEventStartShell"

"Startup"="WLEventStartup"

"Shutdown"="WLEventShutdown"

.

--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'winlogon.exe'(752)

c:\arquiv~1\GbPlugin\gbiehabn.dll

c:\arquivos de programas\GBPLUGIN\gbieh.dll

c:\arquivos de programas\GbPlugin\gbiehcef.dll

- - - - - - - > 'lsass.exe'(808)

c:\windows\system32\aetsprov.dll

- - - - - - - > 'explorer.exe'(2744)

c:\arquivos de programas\GBPLUGIN\gbieh.dll

c:\arquivos de programas\GbPlugin\gbiehcef.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Tempo para conclusão: 2009-06-04 14:16

ComboFix-quarantined-files.txt 2009-06-04 17:15

Pré-execução: 7,718,752,256 bytes disponíveis

Pós execução: 8,083,709,952 bytes disponíveis

177 --- E O F --- 2009-05-14 10:55

PedroN · Junho 7, 2009

Opa BabiFerrer, Você usou o combofix 7 vezes, dessa maneira dificulta realizar uma análise. Vou precisar de uma análise mais detalhada do seu PC.

• Baixe: < Malwarebytes >

• Atualize o programa!

• Escolha o escaneamento Rápido!

• Desabilite programas de proteção,ao executar o malwarebytes.

• Procure enviar os ítens detectados para a quarentena,clicando em Remover itens.

• Para maiores detalhes: < Link >

-----------------------

• Poste, o relatório: mbam-log-2008-xx-xx (00-00-00).txt.

Depois execute o RSIT

Faça o download do Random's System Information Tool (RSIT)

http://images.malwareremoval.com/random/RSIT.exe

Salve na sua área de trabalho.

◘ Execute o RSIT.exe.

◘ Haverá uma janela informativa:

◘ List files/folders created or modified in the last: 1 month

◘ Clique em Continue.

Quando terminar, dois blocos de notas serão abertos:

log.txt -> abrirá maximizado

info.txt -> abrirá minimizado.

poste o arquivo log.txt na sua proxima resposta.

Uma cópia desses arquivos ficará salva na pasta C:\RSIT

Obs: Se o seu firewall alertar sobre o arquivo rsit.exe tentando se conectar, certifique-se de permitir (allow).

BabiFerrer · Junho 8, 2009

Opa BabiFerrer, Você usou o combofix 7 vezes, dessa maneira dificulta realizar uma análise. Vou precisar de uma análise mais detalhada do seu PC.

• Baixe: < Malwarebytes >

• Atualize o programa!

• Escolha o escaneamento Rápido!

• Desabilite programas de proteção,ao executar o malwarebytes.

• Procure enviar os ítens detectados para a quarentena,clicando em Remover itens.

• Para maiores detalhes: < Link >

-----------------------

• Poste, o relatório: mbam-log-2008-xx-xx (00-00-00).txt.

Depois execute o RSIT

Faça o download do Random's System Information Tool (RSIT)

http://images.malwareremoval.com/random/RSIT.exe

Salve na sua área de trabalho.

◘ Execute o RSIT.exe.

◘ Haverá uma janela informativa:

◘ List files/folders created or modified in the last: 1 month

◘ Clique em Continue.

Quando terminar, dois blocos de notas serão abertos:

log.txt -> abrirá maximizado

info.txt -> abrirá minimizado.

poste o arquivo log.txt na sua proxima resposta.

Uma cópia desses arquivos ficará salva na pasta C:\RSIT

Obs: Se o seu firewall alertar sobre o arquivo rsit.exe tentando se conectar, certifique-se de permitir (allow).

Malwarebytes' Anti-Malware 1.37

Versão do banco de dados: 2227

Windows 5.1.2600 Service Pack 3

08/06/2009 11:10:50

mbam-log-2009-06-08 (11-10-50).txt

Tipo de Verificação: Rápida

Objetos verificados: 102607

Tempo decorrido: 7 minute(s), 32 second(s)

Processos da Memória infectados: 0

Módulos de Memória Infectados: 0

Chaves do Registro infectadas: 0

Valores do Registro infectados: 0

Ítens do Registro infectados: 0

Pastas infectadas: 0

Arquivos infectados: 0

Processos da Memória infectados:

(Nenhum ítem malicioso foi detectado)

Módulos de Memória Infectados:

(Nenhum ítem malicioso foi detectado)

Chaves do Registro infectadas:

(Nenhum ítem malicioso foi detectado)

Valores do Registro infectados:

(Nenhum ítem malicioso foi detectado)

Ítens do Registro infectados:

(Nenhum ítem malicioso foi detectado)

Pastas infectadas:

(Nenhum ítem malicioso foi detectado)

Arquivos infectados:

(Nenhum ítem malicioso foi detectado)

Logfile of random's system information tool 1.06 (written by random/random)

Run by Administrador at 2009-06-08 11:13:33

Microsoft Windows XP Professional Service Pack 3

System drive C: has 8 GB (41%) free of 19 GB

Total RAM: 958 MB (49% free)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:14, on 08/06/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16827)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\ARQUIV~1\GbPlugin\GbpSv.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\Arquivos de programas\SafeNet\BSecClient\axmonitor.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\aetcrss1.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\SCardSvr.exe

C:\WINDOWS\system32\dklog.exe

C:\WINDOWS\system32\dkvcm.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\dkcktkn.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZSTC10.exe

C:\Documents and Settings\Administrador.OEM\Desktop\RSIT.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\Documents and Settings\Administrador.OEM\Desktop\Administrador.exe

C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE