[Arquivado] PC muito lento

x_confused · Dezembro 12, 2009

Boa tarde, segue abaixo os logs do combofix e hijackthis respectivamente. PC está muito lento, sons do sistema operacional saem todos quebrados.

COMBOFIX:

ComboFix 09-12-11.05 - Lucas Tetslaff 12/12/2009 12:39:17.1.2 - x86

Executando de: c:\documents and settings\Lucas Tetslaff\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

ADS - drivers: deleted 208 bytes in 1 streams.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\arquivos de programas\GbPlugin\gbiehcef.dll

c:\recycler\S-1-5-21-1292428093-527237240-682003330-1003(2)

c:\windows\system32\Ijl11.dll

.

(((((((((((((((( Arquivos/Ficheiros criados de 2009-11-12 to 2009-12-12 ))))))))))))))))))))))))))))

.

2009-12-12 14:39 . 2009-12-12 14:39 12568 ----a-w- c:\windows\system32\drivers\PROCEXP113.SYS

2009-12-12 14:23 . 2009-12-12 14:23 -------- d--h--w- c:\windows\system32\GroupPolicy

2009-12-12 11:33 . 2009-12-12 11:33 -------- d-----w- C:\1fa747f9c7f3e8afe8c5f08397d213f1

2009-12-12 11:28 . 2009-12-12 11:28 -------- d-----w- c:\windows\system32\XPSViewer

2009-12-12 11:27 . 2009-12-12 11:27 -------- d-----w- c:\arquivos de programas\MSBuild

2009-12-12 11:26 . 2009-12-12 11:26 -------- d-----w- c:\arquivos de programas\Reference Assemblies

2009-12-12 11:25 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll

2009-12-12 11:23 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll

2009-12-12 11:23 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll

2009-12-12 11:23 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe

2009-12-12 11:23 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe

2009-12-12 11:23 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll

2009-12-12 11:23 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll

2009-12-12 11:23 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll

2009-12-12 11:23 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll

2009-12-12 11:23 . 2009-12-12 11:25 -------- d-----w- C:\009acd6f609fcd6436

2009-12-12 11:15 . 2009-12-10 11:23 2063640 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Avg8\update\backup\avgcorex.dll

2009-12-12 11:14 . 2009-12-10 11:23 3514648 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Avg8\update\backup\avgui.exe

2009-12-12 11:14 . 2009-12-10 11:23 2029336 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Avg8\update\backup\avgtray.exe

2009-12-12 10:51 . 2009-12-12 10:51 -------- d-----w- c:\arquivos de programas\MSXML 6.0

2009-12-12 10:48 . 2009-12-12 10:48 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache

2009-12-10 00:04 . 2006-08-21 09:14 128896 -c----w- c:\windows\system32\dllcache\fltmgr.sys

2009-12-09 23:37 . 2009-12-09 23:37 -------- d-----w- c:\arquivos de programas\Microsoft

2009-11-30 11:48 . 2009-11-30 11:48 -------- d-----w- c:\documents and settings\Lucas Tetslaff\Dados de aplicativos\TeamViewer

2009-11-30 11:47 . 2009-11-30 11:47 -------- d-----w- c:\documents and settings\Lucas Tetslaff\temp

2009-11-25 21:01 . 2005-09-20 12:36 143360 ----a-w- c:\windows\system32\igfxres.dll

2009-11-23 19:36 . 2009-11-23 19:36 -------- d-----w- c:\documents and settings\Lucas Tetslaff\Dados de aplicativos\ATI

2009-11-23 19:30 . 2006-05-03 13:57 520192 ------w- c:\windows\system32\ati2sgag.exe

2009-11-23 19:30 . 2009-11-23 19:31 -------- d-----w- c:\arquivos de programas\ATI Technologies

2009-11-23 19:29 . 2009-11-23 19:29 -------- d-----w- C:\ATI

2009-11-23 18:32 . 2006-05-03 16:29 1408000 ----a-w- c:\windows\system32\ativvaxx.dll

2009-11-23 18:32 . 2004-08-04 02:45 516768 -c--a-w- c:\windows\system32\dllcache\ativvaxx.dll

2009-11-23 18:32 . 2006-05-03 16:50 1540608 -c--a-w- c:\windows\system32\dllcache\ati2mtag.sys

2009-11-23 18:32 . 2006-05-03 16:50 1540608 ----a-w- c:\windows\system32\drivers\ati2mtag.sys

2009-11-23 18:32 . 2006-05-03 16:35 2693280 ----a-w- c:\windows\system32\ati3duag.dll

2009-11-23 18:32 . 2004-08-04 02:45 1888992 -c--a-w- c:\windows\system32\dllcache\ati3duag.dll

2009-11-23 18:32 . 2004-08-04 02:45 870784 -c--a-w- c:\windows\system32\dllcache\ati3d1ag.dll

2009-11-23 18:32 . 2004-08-04 02:45 870784 ----a-w- c:\windows\system32\ati3d1ag.dll

2009-11-23 18:32 . 2006-05-03 16:51 258048 ----a-w- c:\windows\system32\ati2dvag.dll

2009-11-23 18:32 . 2006-05-03 16:09 282624 ----a-w- c:\windows\system32\ati2cqag.dll

2009-11-23 18:32 . 2004-08-04 02:45 229376 -c--a-w- c:\windows\system32\dllcache\ati2cqag.dll

2009-11-23 18:32 . 2004-08-04 02:45 201728 -c--a-w- c:\windows\system32\dllcache\ati2dvag.dll

2009-11-19 12:57 . 2009-11-19 12:57 664 ----a-w- c:\windows\system32\d3d9caps.dat

2009-11-17 19:09 . 2009-11-23 18:47 7201 ----a-w- C:\b612log.dat

2009-11-17 18:10 . 2009-12-01 13:56 363196 ----a-w- C:\DvrMainLog.dat

2009-11-17 18:08 . 2009-11-23 19:45 6464 ----a-w- C:\SettingLog.dat

2009-11-17 18:08 . 2009-11-23 18:59 84 ----a-w- C:\MP4DBINFO.dat

2009-11-17 18:08 . 2009-12-01 13:48 -------- d-----w- C:\M4DATA

2009-11-17 18:02 . 2009-11-30 15:28 25172 ----a-w- c:\windows\AngelCam.dat

2009-11-17 17:58 . 2009-02-04 16:29 64404 ----a-w- c:\windows\system32\drivers\SAA7146.SYS

2009-11-17 17:58 . 2009-02-04 16:29 233472 ----a-w- c:\windows\system32\drivers\SAA46_32.DLL

2009-11-17 17:58 . 2009-02-04 16:28 54528 ----a-w- c:\windows\system32\drivers\DVR7146.sys

2009-11-17 17:42 . 2009-11-17 17:42 -------- d-sh--w- c:\documents and settings\Administrador\IETldCache

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-12-12 14:55 . 2009-08-12 19:10 -------- d-----w- c:\arquivos de programas\GbPlugin

2009-12-12 11:30 . 2001-10-28 15:07 466130 ----a-w- c:\windows\system32\perfh016.dat

2009-12-12 11:30 . 2001-10-28 15:07 77878 ----a-w- c:\windows\system32\perfc016.dat

2009-12-10 21:19 . 2008-10-04 00:22 1 ----a-w- c:\documents and settings\Lucas Tetslaff\Dados de aplicativos\BrOffice.org2\user\uno_packages\cache\stamp.sys

2009-12-10 21:19 . 2008-10-04 00:20 -------- d-----w- c:\documents and settings\Lucas Tetslaff\Dados de aplicativos\BrOffice.org2

2009-12-10 10:43 . 2009-08-12 19:10 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\GbPlugin

2009-12-09 23:20 . 2009-07-15 14:08 -------- d-----w- c:\arquivos de programas\Messenger Plus! Live

2009-12-09 18:20 . 2009-06-18 18:18 -------- d-----w- c:\arquivos de programas\DreaMule

2009-11-23 19:30 . 2008-06-30 18:23 -------- d--h--w- c:\arquivos de programas\InstallShield Installation Information

2009-11-23 19:29 . 2008-06-30 18:21 -------- d-----w- c:\arquivos de programas\Arquivos comuns\InstallShield

2009-11-23 18:54 . 2009-11-23 18:53 -------- d-----w- c:\arquivos de programas\DVR SYSTEM

2009-10-29 07:42 . 2004-08-04 03:45 916480 ----a-w- c:\windows\system32\wininet.dll

2009-10-23 16:32 . 2009-02-26 15:28 -------- d-----w- c:\documents and settings\Lucas Tetslaff\Dados de aplicativos\Image Zone Express

2009-10-22 17:40 . 2009-08-12 19:11 30504 ----a-w- c:\windows\system32\drivers\gbpkm.sys

2009-10-21 06:01 . 2004-08-04 03:45 75776 ----a-w- c:\windows\system32\strmfilt.dll

2009-10-21 06:01 . 2004-08-04 03:45 25088 ----a-w- c:\windows\system32\httpapi.dll

2009-10-20 14:58 . 2004-08-04 02:00 263552 ----a-w- c:\windows\system32\drivers\http.sys

2009-10-13 10:52 . 2004-08-04 03:45 267776 ----a-w- c:\windows\system32\oakley.dll

2009-10-12 13:52 . 2004-08-04 03:45 69632 ----a-w- c:\windows\system32\raschap.dll

2009-10-12 13:52 . 2004-08-04 03:45 112640 ----a-w- c:\windows\system32\rastls.dll

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]

2009-09-02 14:58 1107200 ----a-w- c:\arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]

"nwiz"="nwiz.exe" [2006-10-22 1622016]

"AVG8_TRAY"="c:\arquiv~1\AVG\AVG8\avgtray.exe" [2009-12-12 2043160]

"iTunesHelper"="c:\arquivos de programas\iTunes\iTunesHelper.exe" [2009-07-13 292128]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]

"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]

"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]

"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]

"QuickTime Task"="c:\arquivos de programas\QuickTime\qttask.exe" [2009-05-26 413696]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\

Direct Web.lnk - c:\arquivos de programas\DVR SYSTEM\Web\DirectWeb.exe [2009-11-23 53248]

Monitor Apache Servers.lnk - c:\apache\bin\ApacheMonitor.exe [2008-6-13 41041]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2009-08-24 11:53 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^HP Digital Imaging Monitor.lnk]

path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\HP Digital Imaging Monitor.lnk

backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

2005-05-12 02:12 49152 ----a-w- c:\arquivos de programas\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]

2005-03-08 04:42 176128 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\hpztsb12.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\Messenger\\msmsgs.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Arquivos de programas\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"=

"c:\\Arquivos de programas\\AVG\\AVG8\\avgemc.exe"=

"c:\\Arquivos de programas\\AVG\\AVG8\\avgupd.exe"=

"c:\\Arquivos de programas\\AVG\\AVG8\\avgnsx.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Arquivos de programas\\DreaMule\\emule.exe"=

"c:\\Arquivos de programas\\Bonjour\\mDNSResponder.exe"=

"c:\\Arquivos de programas\\iTunes\\iTunes.exe"=

"c:\\Arquivos de programas\\DVR SYSTEM\\DvrMain.exe"=

"c:\\Arquivos de programas\\DVR SYSTEM\\SNetEx_c.exe"=

"c:\\Documents and Settings\\Lucas Tetslaff\\temp\\TeamViewer\\Version4\\TeamViewer.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"6531:TCP"= 6531:TCP:zrxlkx

R0 GbpKm;Gbp KernelMode;c:\windows\system32\drivers\gbpkm.sys [12/8/2009 17:11 30504]

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [1/4/2009 17:12 335240]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [1/4/2009 17:12 108552]

R2 Apache2.2;Apache2.2;c:\apache\bin\httpd.exe [13/6/2008 05:05 24635]

R2 avg8emc;AVG Free8 E-mail Scanner;c:\arquiv~1\AVG\AVG8\avgemc.exe [1/4/2009 17:12 908056]

R2 avg8wd;AVG Free8 WatchDog;c:\arquiv~1\AVG\AVG8\avgwdsvc.exe [1/4/2009 17:12 297752]

R2 DivisCTP;DVR WDM Device Driver;c:\windows\system32\drivers\DVR7146.sys [17/11/2009 15:58 54528]

R2 DivisCTS;DVR Capture WDM Secondary Device Driver;c:\windows\system32\drivers\SAA7146.SYS [17/11/2009 15:58 64404]

R2 GbpSv;Gbp Service;c:\arquiv~1\GbPlugin\GbpSv.exe [12/8/2009 17:11 53800]

S2 acphwh;Config Microsoft;c:\windows\system32\svchost.exe -k netsvcs [4/8/2004 01:45 14336]

S2 ctfdfx;Update Support;c:\windows\system32\svchost.exe -k netsvcs [4/8/2004 01:45 14336]

S2 gufzgvr;Helper Windows;c:\windows\system32\svchost.exe -k netsvcs [4/8/2004 01:45 14336]

S2 kfnafyfdt;Helper Center;c:\windows\system32\svchost.exe -k netsvcs [4/8/2004 01:45 14336]

S2 oqvgldxq;Microsoft Shell;c:\windows\system32\svchost.exe -k netsvcs [4/8/2004 01:45 14336]

S2 yzgbiwr;System Time;c:\windows\system32\svchost.exe -k netsvcs [4/8/2004 01:45 14336]

S2 zxaqji;System Monitor;c:\windows\system32\svchost.exe -k netsvcs [4/8/2004 01:45 14336]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

oqvgldxq

acphwh

ctfdfx

kfnafyfdt

yzgbiwr

zxaqji

gufzgvr

.

------- Scan Suplementar -------

.

uStart Page = hxxp://www.terra.com.br/

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} - hxxps://imagem.caixa.gov.br/cab/gbpdist.cab

.

- - - - ORFÃOS REMOVIDOS - - - -

ShellExecuteHooks-{E37CB5F0-51F5-4395-A808-5FA49E399003} - c:\arquivos de programas\GbPlugin\gbiehcef.dll

Notify- GbPluginCef - c:\arquivos de programas\GbPlugin\gbiehCef.dll

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-12-12 13:03

Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL]

"ImagePath"="\"c:\mysql\bin\mysqld-nt\" --defaults-file=\"c:\mysql\my.ini\" MySQL"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\acphwh]

"ServiceDll"="c:\arquivos de programas\Internet Explorer\pzhhnul.dll"

--

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ctfdfx]