[Resolvido!] MIcro estranho

hanah · Julho 18, 2009

Há mais de um mês o micro vem apresentando uns sintomas estranhos. Quando clico na IE abre mais de uma vez,quando clico em um site as vezes abre outro ou abre e fecha varias vezes, quando vou fechar um site fecha varios outros que estou usando, como aconteceu agora e tive que postar de novo! Além de está lento e também dá umas travadas. Tentei fazer Restauração do Sistema onde deu certo na primeira vez, mas como tentei restaurar em seguida pra uma data anterior,deu a informação de que a Restauração não tinha sido completada,depois disso não conseguir mais,desfiz a primeira e sempre que ligo o micro aparece uma janela com a informação (an ansupported operation was attempte).Já desativei e ativei a restauração e nada! Agora não volta nem os meses e datas pra escolher um ponto de restauração.

Já passei antivirus (agora o Avira),antispyware, CCleaner, MV RegCleaner, Malwarebytes Anti-Malware (que detectou 14 obj infectados enviados pra quarentena)com isso o Avira detectou 4 infecçõs q foram mandadas também pra quarentena, ComboFix, Kaspersky Removal Tool. Após o Malwarebytes não foi detectado mais nada de vírus, mas o micro continua do mesmo jeito! Será que vou ter que formatar?

Agradeço a atenção!

Logfile of HijackThis v1.99.1

Scan saved at 13:32:36, on 18/7/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

C:\Arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\Arquivos de programas\SigmaTel\C-Major Audio\WDM\STacSV.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\sttray.exe

C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe

C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

C:\Arquivos de programas\Arquivos comuns\InstallShield\UpdateService\issch.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqSTE08.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\Arquivos de programas\Windows Live\Toolbar\wltuser.exe

C:\Arquivos de programas\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Arquivos de programas\Windows Live\Contacts\wlcomm.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\Documents and Settings\PESSOAL\Meus documentos\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R3 - URLSearchHook: Barra de Ferramentas do Yahoo! - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn0\yt.dll

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn0\yt.dll

O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - (no file)

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Arquivos de programas\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll

O2 - BHO: (no name) - {D5B72AED-E54A-11D6-B1B2-444553540000}B1B2-444553540000} - (no file)

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Arquivos de programas\Windows Live\Toolbar\wltcore.dll

O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll

O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Arquivos de programas\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

O3 - Toolbar: Barra de Ferramentas do Yahoo! - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn0\yt.dll

O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Arquivos de programas\Windows Live\Toolbar\wltcore.dll

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [sigmatelSysTrayApp] sttray.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [RemoteControl] "C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [LanguageShortcut] "C:\Arquivos de programas\CyberLink\PowerDVD\Language\Language.exe"

O4 - HKLM\..\Run: [HP Software Update] C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [iSUSPM Startup] "C:\Arquivos de programas\Arquivos comuns\InstallShield\UpdateService\isuspm.exe" -startup

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Arquivos de programas\Arquivos comuns\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [avgnt] "C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Incluir no Blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Arquivos de programas\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Incluir no Blog no Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Arquivos de programas\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Seleção HP Smart - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Arquivos de programas\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Arquivos de programas\Yahoo!\Common\Yinsthelper.dll

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{277F5272-1C4B-4CA5-9BC3-1A7071CEC0E6}: NameServer = 200.223.0.83 200.223.0.84

O17 - HKLM\System\CS1\Services\Tcpip\..\{277F5272-1C4B-4CA5-9BC3-1A7071CEC0E6}: NameServer = 200.223.0.83 200.223.0.84

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Arquivos de programas\Windows Live\Mail\mailcomm.dll

O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe

O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Arquivos de programas\SigmaTel\C-Major Audio\WDM\STacSV.exe

O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Arquivos de programas\Yahoo!\SoftwareUpdate\YahooAUService.exe

jgarcia · Julho 20, 2009

Opa hanah,

Poste o log do ComboFix.

Abraços.

hanah · Julho 21, 2009

Opa hanah,

Poste o log do ComboFix.

Abraços.

hanah · Julho 21, 2009

Passei o ComboFix apos o Malwarebytes,aí vai o log:

ComboFix 09-07-14.08 - PESSOAL 15/07/2009 20:51.1.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.1015.655 [GMT -3:00]

Executando de: c:\documents and settings\PESSOAL\Desktop\ComboFix.exe

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

ATENÇAO - ESTA MAQUINA NAO TEM O CONSOLE DE RECUPERAÇÃO INSTALADA !!

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\Installer\100e1b.msp

c:\windows\Installer\100e1f.msp

c:\windows\Installer\2b4ee.msp

c:\windows\Installer\2b4f2.msp

c:\windows\Installer\2b4f6.msp

c:\windows\Installer\4c6947.msp

c:\windows\Installer\b31a67.msi

c:\windows\system32\AutoRun.inf

c:\windows\system32\Prefetchxs

c:\windows\system32\Prefetchxs\bandasouldoghetto2@hotmail.com

c:\windows\system32\Prefetchxs\dri_card@yahoo.com.br

c:\windows\system32\Prefetchxs\fashi.amint@gmail.com

c:\windows\system32\Prefetchxs\luciana_santoscard@hotmail.com

c:\windows\system32\Prefetchxs\paula.ufpe@hotmail.com

c:\windows\system32\Prefetchxs\toninhoolodum

c:\windows\system32\Prefetchxs\uid=10679832580636741220

c:\windows\system32\Prefetchxs\uid=10927616576801713134

c:\windows\system32\Prefetchxs\uid=10967132778198289171

c:\windows\system32\Prefetchxs\uid=11048902476419428187

c:\windows\system32\Prefetchxs\uid=1142420208158058615

c:\windows\system32\Prefetchxs\uid=11674897352555166147

c:\windows\system32\Prefetchxs\uid=11850153784090252434

c:\windows\system32\Prefetchxs\uid=12238114282886943720

c:\windows\system32\Prefetchxs\uid=12280337421963902597

c:\windows\system32\Prefetchxs\uid=1328073293012303488

c:\windows\system32\Prefetchxs\uid=13464177219910612897

c:\windows\system32\Prefetchxs\uid=13485108702241006492

c:\windows\system32\Prefetchxs\uid=13578099259492973272

c:\windows\system32\Prefetchxs\uid=13777022112848520999

c:\windows\system32\Prefetchxs\uid=13923704469191375116

c:\windows\system32\Prefetchxs\uid=13928272378301329850

c:\windows\system32\Prefetchxs\uid=14128349641728472351

c:\windows\system32\Prefetchxs\uid=1415570726509339614

c:\windows\system32\Prefetchxs\uid=141685310189570986

c:\windows\system32\Prefetchxs\uid=14283058951348670629

c:\windows\system32\Prefetchxs\uid=14423849403227110143

c:\windows\system32\Prefetchxs\uid=14751486113182275386

c:\windows\system32\Prefetchxs\uid=1488815517577712741

c:\windows\system32\Prefetchxs\uid=14964894082567593108

c:\windows\system32\Prefetchxs\uid=15448435197845366675

c:\windows\system32\Prefetchxs\uid=15694918437928818817

c:\windows\system32\Prefetchxs\uid=15761905846967789979

c:\windows\system32\Prefetchxs\uid=15885983062090610117

c:\windows\system32\Prefetchxs\uid=15923381616139035666

c:\windows\system32\Prefetchxs\uid=16060766673666014208

c:\windows\system32\Prefetchxs\uid=16081778442138410601

c:\windows\system32\Prefetchxs\uid=1624021439503106680

c:\windows\system32\Prefetchxs\uid=16367735134131155931

c:\windows\system32\Prefetchxs\uid=16410051992360965353

c:\windows\system32\Prefetchxs\uid=16823743788352678955

c:\windows\system32\Prefetchxs\uid=17116613574030473493

c:\windows\system32\Prefetchxs\uid=17156437964098033985

c:\windows\system32\Prefetchxs\uid=17157710108082146990

c:\windows\system32\Prefetchxs\uid=17176791614356912580

c:\windows\system32\Prefetchxs\uid=17438354418361314240

c:\windows\system32\Prefetchxs\uid=17729923203297868074

c:\windows\system32\Prefetchxs\uid=17942743879279759359

c:\windows\system32\Prefetchxs\uid=17954191863854365597

c:\windows\system32\Prefetchxs\uid=18030404729815448730

c:\windows\system32\Prefetchxs\uid=2060106617715926186

c:\windows\system32\Prefetchxs\uid=2128155776427407866

c:\windows\system32\Prefetchxs\uid=2474725721262442844

c:\windows\system32\Prefetchxs\uid=2844432896120804248

c:\windows\system32\Prefetchxs\uid=3140459874036391583

c:\windows\system32\Prefetchxs\uid=3279733039677704517

c:\windows\system32\Prefetchxs\uid=3306829314661347937

c:\windows\system32\Prefetchxs\uid=3568810179542853581

c:\windows\system32\Prefetchxs\uid=3744366729319147775

c:\windows\system32\Prefetchxs\uid=3805380566523333352

c:\windows\system32\Prefetchxs\uid=4139746508139406247

c:\windows\system32\Prefetchxs\uid=4244696561163922489

c:\windows\system32\Prefetchxs\uid=4680293599346741289

c:\windows\system32\Prefetchxs\uid=4799991980315442748

c:\windows\system32\Prefetchxs\uid=4881535898465974038

c:\windows\system32\Prefetchxs\uid=489849182913727093

c:\windows\system32\Prefetchxs\uid=5266207742186950447

c:\windows\system32\Prefetchxs\uid=5385101075344995941

c:\windows\system32\Prefetchxs\uid=5554314753648559553

c:\windows\system32\Prefetchxs\uid=5718023149181907186

c:\windows\system32\Prefetchxs\uid=5757604830722573551

c:\windows\system32\Prefetchxs\uid=6037225099814315814

c:\windows\system32\Prefetchxs\uid=6203545570645890183

c:\windows\system32\Prefetchxs\uid=6335236983402196376

c:\windows\system32\Prefetchxs\uid=639943330839296837

c:\windows\system32\Prefetchxs\uid=641745365503153305

c:\windows\system32\Prefetchxs\uid=6516005330102073153

c:\windows\system32\Prefetchxs\uid=6789295816574705485

c:\windows\system32\Prefetchxs\uid=737667548759169978

c:\windows\system32\Prefetchxs\uid=7526325856359735876

c:\windows\system32\Prefetchxs\uid=7553956261597646382

c:\windows\system32\Prefetchxs\uid=7697976924229513692

c:\windows\system32\Prefetchxs\uid=7776519713284640561

c:\windows\system32\Prefetchxs\uid=7789193936352252685

c:\windows\system32\Prefetchxs\uid=8199205274737826440

c:\windows\system32\Prefetchxs\uid=8223999366097015620

c:\windows\system32\Prefetchxs\uid=8291363777214520982

c:\windows\system32\Prefetchxs\uid=8473980637995362275

c:\windows\system32\Prefetchxs\uid=8562032400019862023

c:\windows\system32\Prefetchxs\uid=8644596802152029487

c:\windows\system32\Prefetchxs\uid=9069806824722772790

c:\windows\system32\Prefetchxs\uid=9117539128637488672

c:\windows\system32\Prefetchxs\uid=9765072274731384933

.

(((((((((((((((( Arquivos/Ficheiros criados de 2009-06-15 to 2009-07-15 ))))))))))))))))))))))))))))

.

2009-07-13 22:59 . 2009-07-13 22:59 -------- d-----w- c:\docume~1\PESSOAL\DADOSD~1\Malwarebytes

2009-07-13 22:59 . 2009-07-13 16:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-07-13 22:59 . 2009-07-13 22:59 -------- d-----w- c:\arquivos de programas\Malwarebytes' Anti-Malware

2009-07-13 22:59 . 2009-07-13 22:59 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes

2009-07-13 22:59 . 2009-07-13 16:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-07-08 02:28 . 2009-07-08 02:28 -------- d-----w- c:\arquivos de programas\CCleaner

2009-07-06 01:20 . 2009-07-06 01:20 -------- d-----w- c:\docume~1\PESSOAL\DADOSD~1\Yahoo!

2009-07-06 01:19 . 2009-07-06 01:19 -------- d-----w- C:\f0c0c532e21a9c32d5

2009-07-05 14:50 . 2009-03-30 13:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys

2009-07-05 14:50 . 2009-02-13 15:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys

2009-07-05 14:50 . 2009-02-13 15:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys

2009-07-05 14:50 . 2009-07-06 01:20 -------- d-----w- c:\arquivos de programas\Avira

2009-07-05 12:06 . 2009-07-05 12:06 -------- d-----w- c:\windows\system32\wbem\Repository

2009-07-05 04:58 . 2009-07-05 05:00 170131 ----a-w- c:\windows\hpqins00.dat

2009-07-05 01:45 . 2009-07-06 01:20 -------- d-----w- c:\arquivos de programas\ESET

2009-07-04 01:24 . 2009-07-04 01:24 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Yahoo!

2009-07-03 22:10 . 2009-07-08 21:24 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Spybot - Search & Destroy

2009-07-03 22:10 . 2009-07-06 01:15 -------- d-----w- c:\arquivos de programas\Spybot - Search & Destroy

2009-07-03 20:09 . 2009-07-03 20:09 -------- d-sh--w- c:\documents and settings\PESSOAL\IECompatCache

2009-06-30 04:15 . 2009-06-30 04:15 -------- d-----w- c:\arquivos de programas\Marcos Velasco Security

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-07-06 01:20 . 2009-02-08 03:04 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Avira

2009-07-06 01:18 . 2008-12-29 22:33 -------- d-----w- c:\arquivos de programas\SereneScreen

2009-07-04 01:25 . 2008-12-17 00:00 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Yahoo! Companion

2009-07-04 01:24 . 2008-12-16 23:53 -------- d-----w- c:\arquivos de programas\Yahoo!

2009-06-18 20:39 . 2008-10-25 20:53 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\HPSSUPPLY

2009-06-16 14:39 . 2008-04-14 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll

2009-06-16 14:39 . 2008-04-14 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll

2009-06-10 22:58 . 2008-04-14 12:00 79022 ----a-w- c:\windows\system32\perfc016.dat

2009-06-10 22:58 . 2008-04-14 12:00 468108 ----a-w- c:\windows\system32\perfh016.dat

2009-06-10 22:55 . 2009-06-10 22:55 -------- d-----w- c:\arquivos de programas\MSBuild

2009-06-10 22:55 . 2009-06-10 22:55 -------- d-----w- c:\arquivos de programas\Reference Assemblies

2009-06-03 19:10 . 2008-04-14 12:00 1295872 ----a-w- c:\windows\system32\quartz.dll

2009-05-17 15:41 . 2008-09-24 20:02 -------- d-----w- c:\docume~1\PESSOAL\DADOSD~1\Ahead

2009-05-14 18:49 . 2009-05-14 18:49 94360 ----a-w- c:\windows\system32\drivers\epfwtdir.sys

2009-05-14 18:47 . 2009-05-14 18:47 107256 ----a-w- c:\windows\system32\drivers\ehdrv.sys

2009-05-14 18:41 . 2009-05-14 18:41 114472 ----a-w- c:\windows\system32\drivers\eamon.sys

2009-05-13 05:03 . 2008-04-14 12:00 915456 ----a-w- c:\windows\system32\wininet.dll

2009-05-07 15:33 . 2008-04-14 12:00 347136 ----a-w- c:\windows\system32\localspl.dll

2009-04-19 19:50 . 2008-04-14 12:00 1847296 ----a-w- c:\windows\system32\win32k.sys

2009-03-29 10:47 . 2008-12-27 12:04 848 --sha-w- c:\windows\system32\KGyGaAvL.sys

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"swg"="c:\arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-04 68856]

"SpybotSD TeaTimer"="c:\arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-02-26 131072]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-02-26 155648]

"Persistence"="c:\windows\system32\igfxpers.exe" [2007-02-26 131072]

"NeroFilterCheck"="c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]

"RemoteControl"="c:\arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe" [2007-03-15 71216]

"LanguageShortcut"="c:\arquivos de programas\CyberLink\PowerDVD\Language\Language.exe" [2007-01-09 52256]

"HP Software Update"="c:\arquivos de programas\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]

"ISUSPM Startup"="c:\arquivos de programas\Arquivos comuns\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]

"ISUSScheduler"="c:\arquivos de programas\Arquivos comuns\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]

"avgnt"="c:\arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"SigmatelSysTrayApp"="sttray.exe" - c:\windows\sttray.exe [2007-05-06 405504]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\

HP Digital Imaging Monitor.lnk - c:\arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 210520]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\Messenger\\msmsgs.exe"=

"c:\\Documents and Settings\\PESSOAL\\Desktop\\eMule\\emule.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Arquivos de programas\\Windows Live\\Sync\\WindowsLiveSync.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\arquivos de programas\Avira\AntiVir Desktop\sched.exe [5/7/2009 11:50 108289]

S3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\DRIVERS\avfwim.sys --> c:\windows\system32\DRIVERS\avfwim.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]

"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

.

Conteúdo da pasta 'Tarefas Agendadas'

2009-07-15 c:\windows\Tasks\User_Feed_Synchronization-{321242C9-02ED-41AB-82F2-C9285E06EE17}.job

- c:\windows\system32\msfeedssync.exe [2007-08-13 07:31]

.

------- Scan Suplementar -------

.

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

TCP: {277F5272-1C4B-4CA5-9BC3-1A7071CEC0E6} = 200.223.0.83 200.223.0.84

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-07-15 20:55

Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

.

--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------

[HKEY_USERS\S-1-5-21-1220945662-2052111302-1801674531-1003\Software\Microsoft\SystemCertificates\AddressBook*]

@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•6~*]

"6140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

Tempo para conclusão: 2009-07-15 20:57

ComboFix-quarantined-files.txt 2009-07-15 23:57

Pré-execução: 8 pasta(s) 15.688.552.448 bytes disponíveis

Pós execução: 8 pasta(s) 15.848.361.984 bytes disponíveis

232 --- E O F --- 2009-07-15 23:33

jgarcia · Julho 21, 2009

Opa hanah,

1. Baixe o BankerFix 3.0.

2. Desative o seu anti-vírus temporariamente.

3. Dê um duplo-clique sobre o bankerfix.exe. A janela do Banker Fix 3.0 abrir-se-á com a seguinte pergunta Instalar o BankerFix 3.0 / Install BankerFix 3.0 ? >> clique em SIM.

4. Uma janela informando que o BankerFix 3.0 será baixado via internet abrir-se-á >> clique sobre OK e aguarde. Na próxima janela clique em OK mais uma vez, a fim de que o BankerFix 3.0 seja iniciado.

5. Pressione qualquer tecla para dar continuidade ao processo e aguarde até que a varredura se complete. Tenha paciência, pois ela pode demorar alguns minutos.

6. Terminado o scan, leia a mensagem na tela e aperte Enter.

7. Habilite o seu anti-vírus.

8. Retorne com o relatorio.txt do BankerFix (ele estará em C:\LinhaDefensiva\).

9. Depois de postar a sua resposta você poderá deletar a pasta LinhaDefensiva contida no C.

Abraços.

PS.: Caso apareça a seguinte mensagem: Site denunciado como foco de ataques!, não se preocupe e clique sobre Ignorar este alerta.

hanah · Julho 22, 2009

Olá!

Parece que ja detectou de novo arquivo infectado e quando passei o ComboFix e Kaspersky parecia está limpo,como pode? Aí vai...

-------------------------------------------------------

BankerFix 3.0 VALKYRIE - Removedor de Bankers

Linha Defensiva | http://www.linhadefensiva.org

http://www.linhadefensiva.org/bankerfix/

-------------------------------------------------------

Data: 2009-07-22 - 11:12

-------------------------------------------------------

Lista de Definição: 2009-06-26-1 | CORE: 2009-01-21-1

=======================================================

Arquivo infectado detectado: C:\WINDOWS\system32\errox32.dll

Arquivo infectado removido com sucesso!

Arquivo infectado detectado: C:\WINDOWS\system32\imagens.zip

Arquivo infectado removido com sucesso!

Arquivo infectado detectado: C:\WINDOWS\system32\twumk.exe

Arquivo infectado removido com sucesso!

----- Fim -------------------------

hanah · Julho 31, 2009

Oi, Pessoal!

Estou precisando de ajuda, alguém pode responder meu post?

jgarcia · Agosto 1, 2009

Opa hanah,

Primeiramente, desculpe a imensa demora, pois passei por problemas no trabalho e de saúde, os quais impediram o meu acesso ao fórum.

Bem, poste um novo log do ComboFix, a fim de que eu possa analisar a atual situação do micro.

Abraços.

hanah · Agosto 2, 2009

Olá, JGarcia!

Aí vai o log do ComboFix...

ComboFix 09-08-01.06 - PESSOAL 01/08/2009 21:51.2.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.1015.648 [GMT -3:00]

Executando de: c:\documents and settings\PESSOAL\Desktop\ComboFix.exe

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

ATENÇAO - ESTA MAQUINA NAO TEM O CONSOLE DE RECUPERAÇÃO INSTALADA !!

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\Installer\1090f97.msp

c:\windows\Installer\194e820.msp

c:\windows\Installer\19f6d6d.msp

c:\windows\Installer\1b0461.msp

c:\windows\Installer\1b0dba5.msp

c:\windows\Installer\1bd04c.msp

c:\windows\Installer\1d898.msp

c:\windows\Installer\1dbc4.msp

c:\windows\Installer\1df2f.msp

c:\windows\Installer\1e4ec.msp

c:\windows\Installer\20d17d.msp

c:\windows\Installer\215c67.msp

c:\windows\Installer\244670.msp

c:\windows\Installer\29ebcf.msp

c:\windows\Installer\2ac43.msp

c:\windows\Installer\2d7a36.msp

c:\windows\Installer\32e01b.msp

c:\windows\Installer\3590c4.msp

c:\windows\Installer\3f370b.msp

c:\windows\Installer\46628.msp

c:\windows\Installer\49a8cf.msp

c:\windows\Installer\4a0353.msp

c:\windows\Installer\4af5f1.msp

c:\windows\Installer\4bab56.msp

c:\windows\Installer\4d425.msp

c:\windows\Installer\4dab4d.msp

c:\windows\Installer\4ff7dc.msp

c:\windows\Installer\509fa.msp

c:\windows\Installer\50e77c.msp

c:\windows\Installer\51e499.msp

c:\windows\Installer\530069.msp

c:\windows\Installer\54143b.msp

c:\windows\Installer\54ca8b.msp

c:\windows\Installer\58aba5.msp

c:\windows\Installer\5a6ec1.msp

c:\windows\Installer\69c758.msp

c:\windows\Installer\721bab.msp

c:\windows\Installer\730ba9.msp

c:\windows\Installer\77e24e.msp

c:\windows\Installer\80eeb6.msp

c:\windows\Installer\96a53f.msp

c:\windows\Installer\96eda2.msp

c:\windows\Installer\9b1a9a.msp

c:\windows\Installer\9c0086.msp

c:\windows\Installer\9c143c.msp

c:\windows\Installer\9f7e00.msp

c:\windows\Installer\afb9b7.msp

c:\windows\Installer\be35e8.msp

c:\windows\Installer\beac9f.msp

c:\windows\Installer\d432a1.msp

c:\windows\Installer\f6cbfe.msp

.

(((((((((((((((( Arquivos/Ficheiros criados de 2009-07-02 to 2009-08-02 ))))))))))))))))))))))))))))

.

2009-07-17 05:03 . 2009-07-17 23:24 13205536 --sha-w- c:\windows\system32\drivers\fidbox.dat

2009-07-16 15:22 . 2008-04-13 14:45 26112 -c--a-w- c:\windows\system32\dllcache\usbser.sys

2009-07-16 15:22 . 2008-04-13 14:45 26112 ----a-w- c:\windows\system32\drivers\usbser.sys

2009-07-13 22:59 . 2009-07-13 22:59 -------- d-----w- c:\documents and settings\PESSOAL\Dados de aplicativos\Malwarebytes

2009-07-13 22:59 . 2009-07-13 16:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-07-13 22:59 . 2009-07-13 22:59 -------- d-----w- c:\arquivos de programas\Malwarebytes' Anti-Malware

2009-07-13 22:59 . 2009-07-13 22:59 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes

2009-07-13 22:59 . 2009-07-13 16:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-07-08 02:28 . 2009-07-08 02:28 -------- d-----w- c:\arquivos de programas\CCleaner

2009-07-06 01:20 . 2009-07-06 01:20 -------- d-----w- c:\documents and settings\PESSOAL\Dados de aplicativos\Yahoo!