[Resolvido] &nbspAnaálise de log

sddom · Março 16, 2011

Boa noite, o meu computador está travando muito, estao aparecendo alguns problemas com conexoes, usb, rede e as vezes o hd fica com se estivesse completamente cheio.

segue log do hijackthis

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 19:05:33, on 16/03/2011

Platform: Windows Vista SP2 (WinNT 6.00.1906)

MSIE: Internet Explorer v8.00 (8.00.6001.19019)

Boot mode: Normal

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskeng.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\Apoint2K\Apoint.exe

C:\Program Files\Power Manager\PM.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe

C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe

C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe

C:\Program Files\My Lockbox\mylbx.exe

C:\Windows\vsnpstd3.exe

C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe

C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUNMain.exe

C:\Program Files\Unlocker\UnlockerAssistant.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Registry Mechanic\RMTray.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Apoint2K\ApMsgFwd.exe

C:\Program Files\Apoint2K\Apntex.exe

C:\Windows\system32\conime.exe

C:\Program Files\Claro\Claro.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Users\zé de gili\Desktop\HiJackThis.exe

C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANToManager.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll

O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\PROGRAM FILES\GBPLUGIN\gbieh.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe

O4 - HKLM\..\Run: [PowerManager] C:\Program Files\Power Manager\PM.exe

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [sSDMonitor] C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe

O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe"

O4 - HKLM\..\Run: [mylbx] C:\Program Files\My Lockbox\mylbx.exe /a

O4 - HKLM\..\Run: [tsnpstd3] C:\Windows\tsnpstd3.exe

O4 - HKLM\..\Run: [snpstd3] C:\Windows\vsnpstd3.exe

O4 - HKLM\..\Run: [VMonitorVMUVC] "C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe" VMUVC

O4 - HKLM\..\Run: [PSUNMain] "C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUNMain.exe" /Traybar

O4 - HKLM\..\Run: [unlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" -H

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [iSUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RMTray.exe /H

O4 - HKCU\..\Run: [WebcamMaxAutoRun] "C:\Program Files\WebcamMax\WebcamMax.exe" -a

O4 - HKCU\..\Run: [googletalk] C:\Users\zé de gili\AppData\Roaming\Google\Google Talk\googletalk.exe /autostart

O4 - HKCU\..\Run: [Power2GoExpress] NA

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O17 - HKLM\System\CCS\Services\Tcpip\..\{01A6008C-1F25-4C50-A3EA-6C8C71FA07D7}: NameServer = 200.169.117.221 200.169.117.222

O17 - HKLM\System\CCS\Services\Tcpip\..\{8071EA0A-2A40-49D7-8188-ACFAB68E52A5}: NameServer = 200.223.19.98,200.223.0.84

O17 - HKLM\System\CCS\Services\Tcpip\..\{EABD51B3-1F2B-47A5-8CCD-FAF00D0A2CCC}: NameServer = 10.9.8.238,10.9.8.1

O17 - HKLM\System\CS1\Services\Tcpip\..\{01A6008C-1F25-4C50-A3EA-6C8C71FA07D7}: NameServer = 200.169.117.221 200.169.117.222

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O20 - Winlogon Notify: GbPluginBb - C:\Program Files\GbPlugin\gbieh.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll

O23 - Service: Autorun CDROM Monitor - Unknown owner - C:\Windows\system32\SupportAppXL\cdrom_mon.exe

O23 - Service: FSPro Filter Service (fsproflt) - FSPro Labs - C:\Windows\system32\fsproflt.exe

O23 - Service: Gbp Service (GbpSv) - - C:\PROGRA~1\GbPlugin\GbpSv.exe

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Panda Cloud Antivirus Service (NanoServiceMain) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe

O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe

O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--

End of file - 9639 bytes

wings · Março 17, 2011

Olá sddom

*Baixe o ZHPDiag_silent e salve-o no desktop

*Mantenha-se conectado a internet

*Execute-o e cole o relatório apresentado (ZHPDiag.txt)

Caso o relatório fique demasiadamente grande...

*Acesse este link

*Clique [Enviar arquivo]

*Localize o arquivo C:\Arquivos de programas\ZHPDiag\ZHPDiag.txt

*Clique [Abrir] > [Créer le lien Cjoint]

*Cole o endereço criado

sddom · Março 18, 2011

boa noite! eu executo o programa zhpdiag e ele cria alguns atalhos vazios e nao cria o arquivo zhpdiag.txt e aí?

wings · Março 18, 2011

1.

*Execute o arquivo ZHP_Uninstall.exe localizado no desktop

2.

*Baixe o GMER e salve-o no desktop

*Crie uma pasta chamada GMER em C:\ e extraia para lá

*Desative temporariamente o antivírus

*Execute-o

*Caso receba a mensagem de atividade de rootkit e se deseja fazer um scan, clique [NÃO]

Na coluna da direita, desmarque:

[] IAT/EAT

[] Show All

*Clique [scan] e aguarde o término

*Clique [save] e salve no desktop

*Cole o relatório

3.

*Baixe o MalwareBytes e salve-o no desktop

*Instale o programa e aguarde a atualização

*O programa será aberto automaticamente

*Na aba [Verificação], selecione [Verificação completa]

*Clique [Verificar] e selecione a partição onde o Windows está instalado

*Ao finalizar o scan, clique [sIM] > [OK] > [Ver Resultados] > [Remover Selecionados]

*Cole o relatório apresentado

sddom · Março 18, 2011

Eu consegui usar outro zhpdiag veja o resultado:

http://cjoint.com/?1dscbILqEYL

wings · Março 18, 2011

Eu consegui usar outro zhpdiag veja o resultado:

http://cjoint.com/?1dscbILqEYL

OK...

Faça os procedimentos 2 e 3 que solicitei acima.

sddom · Março 20, 2011

GMER 1.0.15.15530 - http://www.gmer.net

Rootkit scan 2011-03-18 12:16:01

Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-4 SAMSUNG_HM160HI rev.HH100-08

Running: gmer.exe; Driver: C:\Users\ZDEGIL~1\AppData\Local\Temp\kgdiykow.sys

---- Kernel code sections - GMER 1.0.15 ----

? C:\Users\ZDEGIL~1\AppData\Local\Temp\mbr.sys O sistema não pode encontrar o arquivo especificado. !

---- User code sections - GMER 1.0.15 ----

.text C:\Windows\system32\services.exe[768] kernel32.dll!FreeLibrary 764E3DB4 5 Bytes JMP 100870B0 C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Gbieh Module/Banco do Brasil)

.text C:\Windows\system32\services.exe[768] kernel32.dll!FreeLibraryAndExitThread 764E4642 5 Bytes JMP 10086F50 C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Gbieh Module/Banco do Brasil)

.text C:\Windows\Explorer.EXE[1816] kernel32.dll!FreeLibrary 764E3DB4 5 Bytes JMP 079070B0 C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Gbieh Module/Banco do Brasil)

.text C:\Windows\Explorer.EXE[1816] kernel32.dll!FreeLibraryAndExitThread 764E4642 5 Bytes JMP 07906F50 C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Gbieh Module/Banco do Brasil)

.text C:\Windows\Explorer.EXE[1816] SHELL32.dll!SHFileOperationW 76D268E8 5 Bytes JMP 10001102 C:\Program Files\Unlocker\UnlockerHook.dll

.text C:\Program Files\Claro\Claro.exe[6292] USER32.dll!SetScrollRange 75F0D185 5 Bytes JMP 003223B0 C:\Program Files\Claro\SkinMagicU.dll (SkinMagic Toolkit/Appspeed Inc.)

.text C:\Program Files\Claro\Claro.exe[6292] USER32.dll!GetSysColorBrush 75F0E21C 5 Bytes JMP 003224A0 C:\Program Files\Claro\SkinMagicU.dll (SkinMagic Toolkit/Appspeed Inc.)

.text C:\Program Files\Claro\Claro.exe[6292] USER32.dll!GetScrollInfo 75F0F073 7 Bytes JMP 00322280 C:\Program Files\Claro\SkinMagicU.dll (SkinMagic Toolkit/Appspeed Inc.)

.text C:\Program Files\Claro\Claro.exe[6292] USER32.dll!ShowScrollBar 75F0F8AE 5 Bytes JMP 00322400 C:\Program Files\Claro\SkinMagicU.dll (SkinMagic Toolkit/Appspeed Inc.)

.text C:\Program Files\Claro\Claro.exe[6292] USER32.dll!SetScrollInfo 75F171D8 7 Bytes JMP 00322330 C:\Program Files\Claro\SkinMagicU.dll (SkinMagic Toolkit/Appspeed Inc.)

.text C:\Program Files\Claro\Claro.exe[6292] USER32.dll!GetSysColor 75F19BF6 5 Bytes JMP 00322440 C:\Program Files\Claro\SkinMagicU.dll (SkinMagic Toolkit/Appspeed Inc.)

.text C:\Program Files\Claro\Claro.exe[6292] USER32.dll!EnableScrollBar 75F2AF53 7 Bytes JMP 00322240 C:\Program Files\Claro\SkinMagicU.dll (SkinMagic Toolkit/Appspeed Inc.)

.text C:\Program Files\Claro\Claro.exe[6292] USER32.dll!GetScrollPos 75F3337D 5 Bytes JMP 003222C0 C:\Program Files\Claro\SkinMagicU.dll (SkinMagic Toolkit/Appspeed Inc.)

.text C:\Program Files\Claro\Claro.exe[6292] USER32.dll!GetScrollRange 75F334A5 5 Bytes JMP 003222F0 C:\Program Files\Claro\SkinMagicU.dll (SkinMagic Toolkit/Appspeed Inc.)

.text C:\Program Files\Claro\Claro.exe[6292] USER32.dll!SetScrollPos 75F33602 5 Bytes JMP 00322370 C:\Program Files\Claro\SkinMagicU.dll (SkinMagic Toolkit/Appspeed Inc.)

.text C:\Program Files\Mozilla Firefox\firefox.exe[7560] ntdll.dll!LdrLoadDll 778B93A8 5 Bytes JMP 00C513F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)

.text C:\Program Files\Mozilla Firefox\plugin-container.exe[7956] USER32.dll!TrackPopupMenu 75F214F3 5 Bytes JMP 67B46373 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)

---- EOF - GMER 1.0.15 ----

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Versão da Base de Dados: 6107

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.19019

20/03/2011 13:09:42

mbam-log-2011-03-20 (13-09-42).txt

Tipo de Verificação: Verificação Completa (C:\|)

Objetos escaneados: 310061

Tempo decorrido: 3 hora(s), 2 minuto(s), 51 segundo(s)

Processos de Memória Infectados: 0

Módulos de Memória Infectados: 0

Chaves de Registro Infectadas: 0

Valores de Registro Infectados: 0

Itens de Dados no Registro Infectados: 0

Pastas Infectadas: 0

Arquivos Infectados: 3

Processos de Memória Infectados: