Logo Hardware.com.br
Marcelobhe
Marcelobhe Novo Membro Registrado
44 Mensagens 1 Curtida

[Resolvido] Computador lento

#1 Por Marcelobhe 24/08/2010 - 16:47
Amigos, boa tarde!

Estou com problemas no meu computador, quando inicio ele está muito lento e no acesso a internet também está lento demais. Já desfragmentei, já rodei os seguinte programas; ATF Cleaner, CCleaner, dvancedSetupPro, Avira e NitroPC e continua muito lento. Alguém por favor me ajude, Obrigado.
Felipe_88
Felipe_88 Ubbergeek Registrado
4.1K Mensagens 256 Curtidas
#2 Por Felipe_88
25/08/2010 - 08:17
Marcelobhe,

*Baixe o HijackThis e salve-o em Meus Documentos
*Instale-o
*Execute-o através do ícone criado no desktop
*Clique em [Open the Misc Tools section]
*Na aba [Misc Tools], desça a barra de rolagem e selecione a caixa "Calculate MD5 of files if possible"
*Clique [Back] > [Scan]
*Clique em [Save log] e salve-o no desktop
*Cole o relatório na sua próxima resposta

No aguardo!
Marcelobhe
Marcelobhe Novo Membro Registrado
44 Mensagens 1 Curtida
#3 Por Marcelobhe
25/08/2010 - 11:04
Prezado Felipe, mais uma vez obrigado pela ajuda. Segue o Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:02:35, on 25/8/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\ARQUIV~1\GbPlugin\GbpSv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe
C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe
C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\aetcrss1.exe
C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe
C:\Arquivos de programas\IObit\Advanced SystemCare 3\AWC.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\NitroPC\NitroPC.exe
C:\WINDOWS\system32\svchost.exe
C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe
C:\Arquivos de programas\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\Arquivos de programas\CDBurnerXP\NMSAccessU.exe
C:\OBBPLUS\aplicacao\infra\tomcat\bin\obbplus.exe
C:\WINDOWS\System32\svchost.exe
C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\alg.exe
C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exec:\windows\system32\userinit.exe
O1 - Hosts: 85.17.165.146 www.brazukas.org
O1 - Hosts: 200.201.163.20 icp.caixa.gov.br # GbPlugin
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: CompSegIB - {2E3C3651-B19C-4DD9-A979-901EC3E930AF} - C:\Arquivos de programas\Scpad\scpsssh2.dll (filesize 214272 bytes, MD5 EE1456457E0F2DAE6F91DB9AEA83F394)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll (filesize 1879896 bytes, MD5 022C2F6DCCDFA0AD73024D254E62AFAC)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll (filesize 2217848 bytes, MD5 A6B5A41C0ED007AB6C43CAD899E533D8)
O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (filesize 408448 bytes, MD5 B7899C3E21B299D7A3C0DA96CAE340BD)
O2 - BHO: CPrintEnhancer Object - {AE84A6AA-A333-4B92-B276-C11E2212E4FE} - C:\Arquivos de programas\HP\Smart Web Printing\SmartWebPrinting.dll (filesize 599472 bytes, MD5 920E34CF9C680B095EB84359AA3F9F21)
O2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\Arquivos de programas\GbPlugin\gbiehcef.dll (filesize 329768 bytes, MD5 BFE8CC14423E7B64B5295E27BF79ED08)
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Arquivos de programas\Ask.com\GenericAskToolbar.dll (filesize 1197448 bytes, MD5 858E56FE2AFCE38AD37E5F675067D1AD)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll (filesize 41760 bytes, MD5 1E57B1A44C7DFFA1C38534279C14B3CE)
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (filesize 73728 bytes, MD5 55E583817A2012FD75F1F8CF87EE760C)
O3 - Toolbar: Foxit Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Arquivos de programas\Ask.com\GenericAskToolbar.dll (filesize 1197448 bytes, MD5 858E56FE2AFCE38AD37E5F675067D1AD)
O4 - HKLM\..\Run: [avgnt] "C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" /min (filesize 209153 bytes, MD5 29680A793F690EEF4AAA68479D2A6DF8)
O4 - HKLM\..\Run: [CertificateRegistration] aetcrss1.exe (filesize 208896 bytes, MD5 EE056AB9BC64B791DF6BBD9EEC7CAC24)
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exeC:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Arquivos de programas\IObit\Advanced SystemCare 3\AWC.exe" /startup (filesize 2349776 bytes, MD5 91728CCDDFBE67D004017F87465CB9D7)
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeC:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NitroPC] "C:\Arquivos de programas\NitroPC\NitroPC.exe" -minimized (filesize 3477504 bytes, MD5 3169D0F56374BAF0D49A229CA739C16D)
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Arquivos de programas\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll (filesize 603040 bytes, MD5 79F7DB36E67B9E8365FA824AD96DF400)
O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll (filesize 603040 bytes, MD5 79F7DB36E67B9E8365FA824AD96DF400)
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Arquivos de programas\PokerStars\PokerStarsUpdate.exe (filesize 562968 bytes, MD5 20DFD90EB268E74E323F1100F329C162)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL (filesize 39464 bytes, MD5 AEF204E782BFA2C8448CB43A58960744)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\system32\shdocvw.dll (filesize 1497088 bytes, MD5 4ADCBD60E860A058D1A6174EFF1ADDFA)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\system32\shdocvw.dll (filesize 1497088 bytes, MD5 4ADCBD60E860A058D1A6174EFF1ADDFA)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll (filesize 1879896 bytes, MD5 022C2F6DCCDFA0AD73024D254E62AFAC)
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll (filesize 1879896 bytes, MD5 022C2F6DCCDFA0AD73024D254E62AFAC)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (filesize 1695232 bytes, MD5 EFF5E5CCA31672BD00AF87D170590AFB)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (filesize 1695232 bytes, MD5 EFF5E5CCA31672BD00AF87D170590AFB)
O9 - Extra button: Cool Hand Poker - {00000000-0000-0000-0000-000000000000} - C:\WINDOWS\system32\shdocvw.dll (HKCU) (filesize 1497088 bytes, MD5 4ADCBD60E860A058D1A6174EFF1ADDFA)
O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\WINDOWS\system32\shdocvw.dll (HKCU) (filesize 1497088 bytes, MD5 4ADCBD60E860A058D1A6174EFF1ADDFA)
O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\WINDOWS\system32\shdocvw.dll (HKCU) (filesize 1497088 bytes, MD5 4ADCBD60E860A058D1A6174EFF1ADDFA)
O9 - Extra button: UltimateBet - {1FBA04EE-3024-11d2-8F1F-0000F87ABD16} - C:\WINDOWS\system32\shdocvw.dll (HKCU) (filesize 1497088 bytes, MD5 4ADCBD60E860A058D1A6174EFF1ADDFA)
O9 - Extra 'Tools' menuitem: UltimateBet - {1FBA04EE-3024-11d2-8F1F-0000F87ABD16} - C:\WINDOWS\system32\shdocvw.dll (HKCU) (filesize 1497088 bytes, MD5 4ADCBD60E860A058D1A6174EFF1ADDFA)
O9 - Extra button: CarbonPoker - {e4e8c758-34b4-44bb-8ef9-1f0786e81d2d} - C:\Documents and Settings\Administrador\Menu Iniciar\Programas\CarbonPoker\CarbonPoker.lnk (HKCU) (filesize 1653 bytes, MD5 6894C29F9B93ABFD9E15DB1C279641CC)
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) -
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://img2.orkut.com/activex/10035/photouploader.cab
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1204908658562
O16 - DPF: {9EC30204-384D-11D3-9CA3-00A024F0AF03} (ValidaUsuario Class) - https://cpne.bradesco.com.br/certifexp.cab
O16 - DPF: {B3D3825B-2120-4B0E-8C45-80ECC1D3E70D} (GeraCert Class) - https://cpne.bradesco.com.br/CA.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin9.valueactive.eu/Register/Branding/olr3313/OCX/flashax.cab
O16 - DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} (GbpDistObj Class) - https://imagem.caixa.gov.br/cab/gbpdist.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveSystemServices.dll (filesize 178040 bytes, MD5 68747446F9D982938DB6B110F2908271)
O20 - Winlogon Notify: GbPluginCef - C:\Arquivos de programas\GbPlugin\gbiehCef.dllC:\Arquivos de programas\GbPlugin\gbiehCef.dll
O21 - SSODL: CompIBBrd - {A3717295-941D-416F-9384-ED1736729F1C} - C:\Arquivos de programas\Scpad\scpLIB.dll (filesize 202032 bytes, MD5 27B364701B74305E26227C1CF4D9B93C)
O22 - SharedTaskScheduler: scpLIB - {A3717295-941D-416F-9384-ED1736729F1C} - C:\Arquivos de programas\Scpad\scpLIB.dll (filesize 202032 bytes, MD5 27B364701B74305E26227C1CF4D9B93C)
O23 - Service: Avira AntiVir Programador (AntiVirSchedulerService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exeC:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exeC:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Arquivos de programas\Ares\chatServer.exeC:\Arquivos de programas\Ares\chatServer.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\Service\AdskScSrv.exeC:\Arquivos de programas\Arquivos comuns\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: EnterpriseDB ApachePHP (EnterpriseDBApachePHP) - Unknown owner - C:\Arquivos de programas\PostgreSQL\EnterpriseDB-ApachePhp\apache\bin\httpd.exe (file missing)
O23 - Service: Gbp Service (GbpSv) - - C:\ARQUIV~1\GbPlugin\GbpSv.exeC:\ARQUIV~1\GbPlugin\GbpSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\1050\Intel 32\IDriverT.exeC:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exeC:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exeC:\Arquivos de programas\Java\jre6\bin\jqs.exe
O23 - Service: MySql - Unknown owner - C:/mysql/bin/mysqld-max.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exeC:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exeC:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe
O23 - Service: NMSAccess - Unknown owner - C:\Arquivos de programas\CDBurnerXP\NMSAccessU.exeC:\Arquivos de programas\CDBurnerXP\NMSAccessU.exe
O23 - Service: Office Banking Bradesco Plus (OBBPLUS) - Banco Bradesco S.A. - C:\OBBPLUS\aplicacao\infra\tomcat\bin\obbplus.exeC:\OBBPLUS\aplicacao\infra\tomcat\bin\obbplus.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exeC:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe
--
End of file - 14065 bytes
Felipe_88
Felipe_88 Ubbergeek Registrado
4.1K Mensagens 256 Curtidas
#4 Por Felipe_88
25/08/2010 - 11:16
joaovictorcongio,

Por gentileza, vamos por etapa, se não pode confundir o usuário...

Marcelobhe,

Desinstale o Hijackthis, pois a versão que passei é a antiga.

Já concertei o Link anterior, você pode baixar por lá...

*Baixe o MalwareBytes Anti-malware e salve-o no desktop:
*Instale o programa
*Se alguma atualização existir,o download será automático. Aguarde...
*O programa será aberto automaticamente.
*Na aba [Verificação], selecione a opção [Verificação completa]
*Clique em [Verificar] e selecione as unidades (C:\ e D:\) a serem examinadas
*Ao término do scan, poderá ser interrogado se deseja remover objetos da memória. Clique [SIM] > [OK] > [Mostrar Resultados]
*Selecione todos os resultados e clique em [Remover Selecionados]
*Um relatório (mbam-log-ano-mês-data.txt) será apresentado.
*Cole-o na sua próxima resposta junto com um novo Log do Hijackthis.

No aguardo!
Marcelobhe
Marcelobhe Novo Membro Registrado
44 Mensagens 1 Curtida
#12 Por Marcelobhe
25/08/2010 - 13:25
Segue relatórios solicitados:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Versão da Base de Dados: 4475
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
25/8/2010 13:11:05
mbam-log-2010-08-25 (13-11-05).txt
Tipo de Verificação: Verificação Completa (C:\|D:\|)
Objetos escaneados: 215499
Tempo decorrido: 40 minuto(s), 58 segundo(s)
Processos de Memória Infectados: 0
Módulos de Memória Infectados: 0
Chaves de Registro Infectadas: 0
Valores de Registro Infectados: 0
Itens de Dados no Registro Infectados: 0
Pastas Infectadas: 0
Arquivos Infectados: 0
Processos de Memória Infectados:
(Não foram detectados ítens maliciosos)
Módulos de Memória Infectados:
(Não foram detectados ítens maliciosos)
Chaves de Registro Infectadas:
(Não foram detectados ítens maliciosos)
Valores de Registro Infectados:
(Não foram detectados ítens maliciosos)
Itens de Dados no Registro Infectados:
(Não foram detectados ítens maliciosos)
Pastas Infectadas:
(Não foram detectados ítens maliciosos)
Arquivos Infectados:
(Não foram detectados ítens maliciosos)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:14:34, on 25/8/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\ARQUIV~1\GbPlugin\GbpSv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe
C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe
C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\aetcrss1.exe
C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe
C:\Arquivos de programas\IObit\Advanced SystemCare 3\AWC.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\NitroPC\NitroPC.exe
C:\WINDOWS\system32\svchost.exe
C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe
C:\Arquivos de programas\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\Arquivos de programas\CDBurnerXP\NMSAccessU.exe
C:\OBBPLUS\aplicacao\infra\tomcat\bin\obbplus.exe
C:\WINDOWS\System32\svchost.exe
C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\alg.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrador\Meus documentos\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe
O1 - Hosts: 85.17.165.146 www.brazukas.org
O1 - Hosts: 200.201.163.20 icp.caixa.gov.br # GbPlugin
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: CompSegIB - {2E3C3651-B19C-4DD9-A979-901EC3E930AF} - C:\Arquivos de programas\Scpad\scpsssh2.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: CPrintEnhancer Object - {AE84A6AA-A333-4B92-B276-C11E2212E4FE} - C:\Arquivos de programas\HP\Smart Web Printing\SmartWebPrinting.dll
O2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\Arquivos de programas\GbPlugin\gbiehcef.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Arquivos de programas\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Foxit Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Arquivos de programas\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [avgnt] "C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [CertificateRegistration] aetcrss1.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Arquivos de programas\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NitroPC] "C:\Arquivos de programas\NitroPC\NitroPC.exe" -minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Arquivos de programas\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Arquivos de programas\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra button: Cool Hand Poker - {00000000-0000-0000-0000-000000000000} - C:\WINDOWS\system32\shdocvw.dll (HKCU)
O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\WINDOWS\system32\shdocvw.dll (HKCU)
O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\WINDOWS\system32\shdocvw.dll (HKCU)
O9 - Extra button: UltimateBet - {1FBA04EE-3024-11d2-8F1F-0000F87ABD16} - C:\WINDOWS\system32\shdocvw.dll (HKCU)
O9 - Extra 'Tools' menuitem: UltimateBet - {1FBA04EE-3024-11d2-8F1F-0000F87ABD16} - C:\WINDOWS\system32\shdocvw.dll (HKCU)
O9 - Extra button: CarbonPoker - {e4e8c758-34b4-44bb-8ef9-1f0786e81d2d} - C:\Documents and Settings\Administrador\Menu Iniciar\Programas\CarbonPoker\CarbonPoker.lnk (HKCU)
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) -
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://img2.orkut.com/activex/10035/photouploader.cab
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1204908658562
O16 - DPF: {9EC30204-384D-11D3-9CA3-00A024F0AF03} (ValidaUsuario Class) - https://cpne.bradesco.com.br/certifexp.cab
O16 - DPF: {B3D3825B-2120-4B0E-8C45-80ECC1D3E70D} (GeraCert Class) - https://cpne.bradesco.com.br/CA.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin9.valueactive.eu/Register/Branding/olr3313/OCX/flashax.cab
O16 - DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} (GbpDistObj Class) - https://imagem.caixa.gov.br/cab/gbpdist.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: GbPluginCef - C:\Arquivos de programas\GbPlugin\gbiehCef.dll
O21 - SSODL: CompIBBrd - {A3717295-941D-416F-9384-ED1736729F1C} - C:\Arquivos de programas\Scpad\scpLIB.dll
O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon de cache de categorias de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: scpLIB - {A3717295-941D-416F-9384-ED1736729F1C} - C:\Arquivos de programas\Scpad\scpLIB.dll
O23 - Service: Avira AntiVir Programador (AntiVirSchedulerService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Arquivos de programas\Ares\chatServer.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: EnterpriseDB ApachePHP (EnterpriseDBApachePHP) - Unknown owner - C:\Arquivos de programas\PostgreSQL\EnterpriseDB-ApachePhp\apache\bin\httpd.exe (file missing)
O23 - Service: Gbp Service (GbpSv) - - C:\ARQUIV~1\GbPlugin\GbpSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe
O23 - Service: MySql - Unknown owner - C:/mysql/bin/mysqld-max.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe
O23 - Service: NMSAccess - Unknown owner - C:\Arquivos de programas\CDBurnerXP\NMSAccessU.exe
O23 - Service: Office Banking Bradesco Plus (OBBPLUS) - Banco Bradesco S.A. - C:\OBBPLUS\aplicacao\infra\tomcat\bin\obbplus.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe
--
End of file - 11542 bytes
Felipe_88
Felipe_88 Ubbergeek Registrado
4.1K Mensagens 256 Curtidas
#13 Por Felipe_88
25/08/2010 - 15:17
Marcelobhe,


* Baixe o programa do link a baixo:
http://www.funkytoad.com/download/HostsXpert.zip
* Salve-o e descompacte em uma pasta temporária;
* Execute o arquivo HostsXpert.exe;
* Em "File Handling" > clique em "Restore MS Hosts File";
* Uma caixa de confirmação será exibida, clique em "OK";
*Feche o HostsXpert.



*Baixe o ComboFix e salve-o no desktop
*Duplo-clique no arquivo Combofix.exe
*Aceite o contrato

*Se o console de recuperação do Windows já estiver instalado, o ComboFix irá continuar o processo automaticamente. Caso não esteja uma janela, conforme abaixo, será aberta. Clique em [SIM] para aceitar a instalação do mesmo.

Imagem

*Após a instalação, clique em [SIM] para continuar.

Imagem

*Importante: enquanto o ComboFix estiver em execução, não use o mouse nem o teclado!!..... Para interromper o procedimento tecle N ou 2 e depois ENTER.

*O programa será fechado automaticamente

*Cole o relatório criado em C:\combofix.txt
Marcelobhe
Marcelobhe Novo Membro Registrado
44 Mensagens 1 Curtida
#14 Por Marcelobhe
25/08/2010 - 15:57
Felipe, segue relatório solicitado.

ComboFix 10-08-24.0C - Administrador 25/08/2010 15:43:56.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.1015.475 [GMT -3:00]
Executando de: c:\documents and settings\Administrador\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
* AV residente está ativo
.
ADS - drivers: deleted 208 bytes in 1 streams.
((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\My.ini
c:\windows\system32\systeminfo3.dll
c:\windows\system32\WinUpdate
.
(((((((((((((((( Arquivos/Ficheiros criados de 2010-07-25 to 2010-08-25 ))))))))))))))))))))))))))))
.
2010-08-25 15:22 . 2010-04-29 18:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-25 15:22 . 2010-08-25 15:22 -------- d-----w- c:\arquivos de programas\Malwarebytes' Anti-Malware
2010-08-25 15:22 . 2010-04-29 18:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-08-25 13:54 . 2010-08-25 14:27 -------- d-----w- c:\arquivos de programas\Trend Micro
2010-08-25 13:33 . 2010-08-25 13:33 -------- d-----w- c:\arquivos de programas\A.E.T. Europe B.V
2010-08-25 13:33 . 2010-08-25 13:33 -------- d-----w- c:\temp\Safesign3026
2010-08-25 13:33 . 2010-08-25 13:33 -------- d-----w- C:\LOGS
2010-08-25 13:22 . 2010-08-25 13:22 10134 ----a-r- c:\documents and settings\Administrador\Dados de aplicativos\Microsoft\Installer\{29BBA887-0E7E-4CD7-806B-19DDF7150567}\ARPPRODUCTICON.exe
2010-08-25 13:22 . 2010-08-25 13:22 -------- d-----w- c:\arquivos de programas\DIFX
2010-08-25 13:21 . 2005-01-14 15:29 58108 ----a-w- c:\windows\system32\drivers\ezusb.sys
2010-08-25 13:21 . 2010-08-25 13:21 -------- d-----w- c:\arquivos de programas\EZUSB
2010-08-17 13:47 . 2010-08-17 13:47 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\Mozilla-Cache
2010-08-16 15:23 . 2010-08-16 15:23 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\Foxit Software
2010-08-16 15:23 . 2010-08-16 15:23 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\Foxit
2010-08-16 15:22 . 2010-08-16 15:22 -------- d-----w- c:\arquivos de programas\Ask.com
2010-08-16 15:22 . 2010-08-16 15:22 -------- d-----w- c:\arquivos de programas\Foxit Software
2010-08-12 17:53 . 2010-06-14 14:31 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe
2010-08-11 21:35 . 2010-08-13 17:00 -------- d-----w- C:\!KillBox
2010-08-11 21:05 . 2010-08-11 21:05 -------- d-----r- c:\documents and settings\LocalService\Favoritos
2010-08-11 21:04 . 2010-08-11 21:04 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-08-11 18:48 . 2009-11-25 15:19 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-08-11 18:48 . 2009-03-30 13:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-08-11 18:48 . 2009-02-13 15:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-08-11 18:48 . 2009-02-13 15:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-08-11 18:48 . 2010-08-11 18:48 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Avira
2010-08-11 18:48 . 2010-08-11 18:48 -------- d-----w- c:\arquivos de programas\Avira
2010-08-10 10:26 . 2010-08-10 10:26 -------- d-sh--w- c:\documents and settings\Administrador\IECompatCache
2010-08-09 19:25 . 2010-06-24 12:24 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-08-09 19:22 . 2010-08-09 19:23 -------- dc-h--w- c:\windows\ie8
2010-08-09 18:23 . 2010-08-09 18:23 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\TEMP
2010-08-09 18:23 . 2010-08-09 18:25 -------- d-----w- c:\arquivos de programas\NitroPC
2010-08-09 14:34 . 2010-08-09 14:34 -------- d-----w- c:\windows\system32\wbem\Repository
2010-08-09 14:33 . 2010-08-09 14:34 -------- d--h--w- c:\documents and settings\Administrador\Recent(2)
2010-08-06 21:25 . 2010-08-06 21:25 604140 --sha-w- c:\windows\system32\drivers\ISwift3.dat
2010-08-06 21:00 . 2010-08-07 11:09 113933 ----a-w- c:\windows\system32\drivers\klin.dat
2010-08-06 21:00 . 2010-08-07 11:09 97549 ----a-w- c:\windows\system32\drivers\klick.dat
2010-08-06 20:57 . 2010-08-06 20:57 -------- d-----w- c:\arquivos de programas\Kaspersky Lab
2010-08-04 14:13 . 2010-08-09 14:34 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\ASGvis
2010-08-03 14:02 . 2010-08-03 14:02 -------- d-----w- c:\arquivos de programas\Google
2010-07-30 20:45 . 2010-07-30 20:45 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\Canneverbe Limited
2010-07-30 20:45 . 2010-07-30 20:45 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Canneverbe Limited
2010-07-30 20:45 . 2009-11-12 17:48 7168 ----a-w- c:\windows\system32\drivers\StarOpen.sys
2010-07-30 20:45 . 2010-07-30 20:45 -------- d-----w- c:\arquivos de programas\CDBurnerXP
2010-07-28 16:18 . 2010-07-30 20:39 11148 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\DVDXStudio\CloneDVD4\MainApp.dll
2010-07-28 16:18 . 2010-07-28 16:18 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\DVDXStudio
2010-07-28 16:18 . 2010-07-30 20:40 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\Vso
2010-07-28 16:18 . 2010-07-30 20:40 81920 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\ezpinst.exe
2010-07-28 16:18 . 2010-07-30 20:40 47360 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\pcouffin.sys
2010-07-28 16:18 . 2010-07-28 16:18 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2010-07-27 19:43 . 2010-07-27 19:45 -------- d-----w- c:\arquivos de programas\UnderCoverXP
.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-25 18:06 . 2009-12-15 14:45 -------- d-----w- c:\arquivos de programas\PokerStars
2010-08-25 14:29 . 2009-07-16 20:17 -------- d-----w- c:\arquivos de programas\VS Revo Group
2010-08-25 09:51 . 2009-10-22 14:06 -------- d-----w- c:\arquivos de programas\Yahoo!
2010-08-24 18:53 . 2009-07-16 20:19 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Spybot - Search & Destroy
2010-08-24 18:52 . 2008-03-07 16:41 -------- d-----w- c:\arquivos de programas\CCleaner
2010-08-20 16:49 . 2010-05-13 19:41 -------- d-----w- c:\arquivos de programas\CarbonPoker
2010-08-17 17:40 . 2010-01-12 21:22 -------- d-----w- c:\arquivos de programas\Full Tilt Poker
2010-08-16 13:59 . 2008-03-07 16:40 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Adobe
2010-08-12 21:18 . 2008-03-07 16:03 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Microsoft Help
2010-08-12 21:16 . 2001-10-28 12:07 80532 ----a-w- c:\windows\system32\perfc016.dat
2010-08-12 21:16 . 2001-10-28 12:07 472074 ----a-w- c:\windows\system32\perfh016.dat
2010-08-11 17:58 . 2008-04-01 17:37 -------- d-----w- c:\arquivos de programas\Alwil Software
2010-08-11 12:57 . 2009-07-16 20:19 -------- d-----w- c:\arquivos de programas\Spybot - Search & Destroy
2010-08-04 14:13 . 2008-03-07 15:44 -------- d--h--w- c:\arquivos de programas\InstallShield Installation Information
2010-07-30 10:12 . 2009-06-04 13:59 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\GbPlugin
2010-07-30 10:11 . 2009-06-04 13:59 -------- d-----w- c:\arquivos de programas\GbPlugin
2010-07-19 19:48 . 2010-07-19 19:48 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\vlc
2010-07-19 19:46 . 2010-07-19 19:46 -------- d-----w- c:\arquivos de programas\VideoLAN
2010-07-15 16:34 . 2010-07-15 16:34 -------- d-----w- c:\arquivos de programas\FreeTime
2010-06-30 12:32 . 2004-08-04 03:45 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-24 12:24 . 2004-08-04 03:45 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-24 09:02 . 2004-08-04 03:38 1852032 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2004-08-04 02:14 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2004-08-04 03:45 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-16 13:32 . 2010-06-16 13:31 2070251 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\OpenCandy\IE8-WindowsXP-x86-PTB.exe
2010-06-16 13:31 . 2010-06-16 13:31 273338 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\OpenCandy\DlMgrWrappersupport.exe
2010-06-14 14:31 . 2008-03-07 15:15 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:42 . 2004-08-04 03:45 1172480 ----a-w- c:\windows\system32\msxml3.dll
2010-06-09 15:01 . 2009-06-04 13:59 45224 ----a-w- c:\windows\system32\drivers\GbpKm.sys
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-02-04 19:50 1197448 ----a-w- c:\arquivos de programas\Ask.com\GenericAskToolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\arquivos de programas\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\arquivos de programas\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"Advanced SystemCare 3"="c:\arquivos de programas\IObit\Advanced SystemCare 3\AWC.exe" [2010-08-10 2349776]
"NitroPC"="c:\arquivos de programas\NitroPC\NitroPC.exe" [2008-08-20 3477504]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"CertificateRegistration"="aetcrss1.exe" [2009-06-29 208896]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GbPluginCef"="c:\arquiv~1\GbPlugin\gbiehCef.dll" [2010-06-09 329768]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{E37CB5F0-51F5-4395-A808-5FA49E399003}"= "c:\arquivos de programas\GbPlugin\gbiehcef.dll" [2010-06-09 329768]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginCef]
2010-06-09 15:03 329768 ----a-w- c:\arquivos de programas\GbPlugin\gbiehcef.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@=""
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Iniciar o Office Banking Bradesco Plus.lnk]
backup=c:\windows\pss\Iniciar o Office Banking Bradesco Plus.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^MySQL.lnk]
backup=c:\windows\pss\MySQL.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast5
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-10-16 17:28 133104 ----atw- c:\documents and settings\Administrador\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
2007-05-15 18:55 1057328 ----a-w- c:\arquivos de programas\Nero\Nero 7\InCD\InCD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
2006-12-06 01:55 54832 ----a-w- c:\arquivos de programas\CyberLink\PowerDVD\Language\Language.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 18:57 153136 ----a-w- c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2007-04-09 12:23 200704 ----a-w- c:\arquivos de programas\PowerISO\PWRISOVM.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2006-11-23 18:10 56928 ------w- c:\arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2006-11-14 09:21 16270848 ----a-r- c:\windows\RTHDCPL.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc]
2007-05-15 18:55 1628208 ----a-w- c:\arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Arquivos de programas\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Arquivos de programas\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Arquivos de programas\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Arquivos de programas\\Messenger\\msmsgs.exe"=
"c:\\Arquivos de programas\\Ares\\Ares.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Arquivos de programas\\Soulseek\\slsk.exe"=
"c:\\Arquivos de programas\\Megacubo\\megacubo.exe"=
"c:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Documents and Settings\\Administrador\\Configurações locais\\Dados de aplicativos\\Google\\Chrome\\Application\\chrome.exe"=
"c:\\Arquivos de programas\\IObit\\Advanced SystemCare 3\\AWC.exe"=
"c:\\Arquivos de programas\\Avira\\AntiVir Desktop\\avcenter.exe"=
R0 GbpKm;Gbp KernelMode;c:\windows\system32\drivers\GbpKm.sys [4/6/2009 10:59 45224]
R2 AntiVirSchedulerService;Avira AntiVir Programador;c:\arquivos de programas\Avira\AntiVir Desktop\sched.exe [11/8/2010 15:48 108289]
R2 GbpSv;Gbp Service;c:\arquiv~1\GbPlugin\GbpSv.exe [4/6/2009 10:59 54824]
R2 OBBPLUS;Office Banking Bradesco Plus;c:\obbplus\aplicacao\infra\tomcat\bin\obbplus.exe [20/3/2008 14:04 120184]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [10/3/2008 12:21 22528]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
S2 EnterpriseDBApachePHP;EnterpriseDB ApachePHP;"c:\arquivos de programas\PostgreSQL\EnterpriseDB-ApachePhp\apache\bin\httpd.exe" -k runservice --> c:\arquivos de programas\PostgreSQL\EnterpriseDB-ApachePhp\apache\bin\httpd.exe [?]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [10/3/2008 12:21 22528]
S3 EZUSB;EZUSB PC/SC Smart Card Reader;c:\windows\system32\drivers\ezusb.sys [25/8/2010 10:21 58108]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [17/4/2009 12:24 717296]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
getPlusHelper REG_MULTI_SZ getPlusHelper
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\aetsprov]
2009-06-29 16:50 81920 ----a-w- c:\windows\system32\aetsprov.dll
.
Conteúdo da pasta 'Tarefas Agendadas'
2010-08-25 c:\windows\Tasks\AWC AutoSweep.job
- c:\arquivos de programas\IObit\Advanced SystemCare 3\AutoSweep.exe [2009-09-22 17:11]
2010-08-23 c:\windows\Tasks\AWC Update.job
- c:\arquivos de programas\IObit\Advanced SystemCare 3\IObitUpdate.exe [2009-09-22 14:08]
2010-08-25 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 18:07]
2010-08-25 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\arquivos de programas\Ask.com\UpdateTask.exe [2010-02-04 19:50]
.
.
------- Scan Suplementar -------
.
uStart Page = hxxp://www.google.com.br/
IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\arquivos de programas\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
DPF: {9EC30204-384D-11D3-9CA3-00A024F0AF03} - hxxps://cpne.bradesco.com.br/certifexp.cab
DPF: {B3D3825B-2120-4B0E-8C45-80ECC1D3E70D} - hxxps://cpne.bradesco.com.br/CA.cab
DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} - hxxps://imagem.caixa.gov.br/cab/gbpdist.cab
FF - ProfilePath - c:\documents and settings\Administrador\Dados de aplicativos\Mozilla\Firefox\Profiles\ripcee5m.default\
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
.
------- Associação de arquivos/ficheiros -------
.
.scr=AutoCADScriptFile
.
**************************************************************************
Procurando processos ocultos ...
Procurando entradas auto inicializáveis ocultas ...
Procurando ficheiros/arquivos ocultos ...
Varredura completada com sucesso
arquivos/ficheiros ocultos:
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySql]
"ImagePath"="C:/mysql/bin/mysqld-max.exe"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySql]
"ImagePath"="C:/mysql/bin/mysqld-max.exe"
.
--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------
[HKEY_USERS\S-1-5-21-73586283-682003330-1801674531-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f2,e3,c0,7c,58,e0,d2,4d,a8,b3,15,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f2,e3,c0,7c,58,e0,d2,4d,a8,b3,15,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
[HKEY_LOCAL_MACHINE\software\Microsoft\Cryptography\RNG*]
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------
- - - - - - - > 'winlogon.exe'(1016)
c:\arquivos de programas\GbPlugin\gbiehcef.dll
.
Tempo para conclusão: 2010-08-25 15:50:33
ComboFix-quarantined-files.txt 2010-08-25 18:50
Pré-execução: 12 pasta(s) 133.758.730.240 bytes disponíveis
Pós execução: 15 pasta(s) 133.746.429.952 bytes disponíveis
WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
- - End Of File - - B998D0FA23BFABD8DFA1592B3556E8CE
Felipe_88
Felipe_88 Ubbergeek Registrado
4.1K Mensagens 256 Curtidas
#15 Por Felipe_88
25/08/2010 - 19:57
Marcelobhe,


*Clique em [Iniciar] > [Executar] > digite: Combofix /uninstall
*Clique [OK]

Imagem

*Clique em [Executar]
*Aguarde até surgir a mensagem: "ComboFix está desinstalado"

*Clique [OK]


*Baixe o AD-Remover
e salve-o no desktop
*Duplo clique em AD-R.exe
*Clique em [Clean]...aguarde o término. A reinicialização do PC poderá ser solicitada pelo programa.
*Cole o relatório criado em C:\Ad-Report-CLEAN.log
© 1999-2025 Hardware.com.br. Todos os direitos reservados.
Imagem do Modal