Log do HijackThis

[Ingrid]

Olá!!

Estou com dificuldade de baixar o HijackThis v2.0.2, tanto no link aqui do site como no do baixaki, da erro...

Alguém pode me ajudar???

Meu PC tah muito lento, não consigo ativar o modo protegido da internet e agora ele deu pra reiniciar sozinho, acredito que ele possa estar com vírus...

:wacko:

Desde já agradeço!!

[RenatoMejias]

1. Faça o download do DDS e salve no desktop.

Links Alternativos

Link2

• Temporariamente desative seus programas de proteção.
• Duplo clique em dds.scr.
• Irá surgir uma tela preta com algumas informações. Não clique em nada, apenas aguarde!
• Quando terminar, duas janelas abrirão: DDS.txt e Attach.txt.
• Salve os resultados e cole-os no seu tópico.

[Ingrid]

Olá!!

Muito obrigada pela ajuda...

Os resultados estão ai logo a baixo...

Fico no aguardo....

DDS (Ver_10-12-12.01) - NTFSx86

Run by Ingrid at 18:46:23,06 on 09/01/2011

Internet Explorer: 8.0.7600.16385

Microsoft Windows 7 Ultimate 6.1.7600.0.1252.55.1046.18.3062.1817 [GMT -2:00]

AV: avast! Antivirus *Enabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}

SP: avast! Antivirus *Enabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\PROGRA~1\GbPlugin\GbpSv.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskhost.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\igfxpers.exe

C:\Windows\system32\igfxsrvc.exe

C:\Windows\VM_STI.EXE

C:\Program Files\Alwil Software\Avast5\AvastUI.exe

C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Windows Live\Contacts\wlcomm.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\wuauclt.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Common Files\Java\Java Update\jucheck.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Users\Ingrid\Desktop\dds.pif

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com

uStart Page = hxxp://www.google.com.br/

uSearch Bar = hxxp://www.google.com/ie

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

uURLSearchHooks: Messenger Plus Live Brazil Toolbar: {edbca961-4bf8-4cbe-8c63-a11dff9ed2d9} - c:\program files\messenger_plus_live_brazil\tbMes1.dll

mURLSearchHooks: Messenger Plus Live Brazil Toolbar: {edbca961-4bf8-4cbe-8c63-a11dff9ed2d9} - c:\program files\messenger_plus_live_brazil\tbMes1.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

BHO: Auxiliar de Conexão do Windows Live: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: GbIehObj Class: {c41a1c0e-ea6c-11d4-b1b8-444553540000} - c:\program files\gbplugin\gbieh.dll

BHO: GbIehObj Class: {c41a1c0e-ea6c-11d4-b1b8-444553540003} - c:\program files\gbplugin\gbiehcef.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: Messenger Plus Live Brazil Toolbar: {edbca961-4bf8-4cbe-8c63-a11dff9ed2d9} - c:\program files\messenger_plus_live_brazil\tbMes1.dll

TB: Messenger Plus Live Brazil Toolbar: {edbca961-4bf8-4cbe-8c63-a11dff9ed2d9} - c:\program files\messenger_plus_live_brazil\tbMes1.dll

uRun: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun

uRun: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\nero\lib\NMBgMonitor.exe"

uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [NeroFilterCheck] c:\program files\common files\nero\lib\NeroCheck.exe

mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [bigDogPath] c:\windows\VM_STI.EXE VIMICRO USB PC Camera 301x

mRun: [avast5] "c:\program files\alwil software\avast5\avastUI.exe" /nogui

mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorUser = 0 (0x0)

mPolicies-system: EnableInstallerDetection = 0 (0x0)

mPolicies-system: EnableLUA = 0 (0x0)

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xportar para o Microsoft Excel - c:\progra~1\micros~1\office12\EXCEL.EXE/3000

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~1\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~1\office12\REFIEBAR.DLL

Trusted Zone: bancobrasil.com.br\www14

Trusted Zone: bancobrasil.com.br\www2

Trusted Zone: bb.com.br\www

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll

Notify: GbPluginBb - c:\program files\gbplugin\gbieh.dll

Notify: GbPluginCef - c:\program files\gbplugin\gbiehCef.dll

Notify: igfxcui - igfxdev.dll

se: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

se: GbPluginObj Class: {e37cb5f0-51f5-4395-a808-5fa49e399f83} - c:\program files\gbplugin\gbieh.dll

se: GbPluginObj Class: {e37cb5f0-51f5-4395-a808-5fa49e399003} - c:\program files\gbplugin\gbiehcef.dll

============= SERVICES / DRIVERS ===============

R0 GbpKm;Gbp KernelMode;c:\windows\system32\drivers\GbpKm.sys [2010-8-12 46600]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-10-7 165584]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-10-7 17744]

R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-10-7 50768]

R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-10-7 40384]

R2 GbpSv;Gbp Service;c:\progra~1\gbplugin\GbpSv.exe [2010-12-31 54664]

R3 Atc002;NDIS Miniport Driver for Atheros L2 Fast Ethernet Controller;c:\windows\system32\drivers\l260x86.sys [2009-6-10 29184]

R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-10-7 40384]

R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-10-7 40384]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2010-7-10 54632]

S3 fsssvc;Serviço Windows Live Proteção para a Família;c:\program files\windows live\family safety\fsssvc.exe [2010-4-28 704872]

S3 WatAdminSvc;Serviço de Tecnologias de Ativação do Windows;c:\windows\system32\wat\WatAdminSvc.exe [2010-7-10 1343400]

=============== Created Last 30 ================

2010-12-28 01:55:20 -------- d-----w- c:\program files\RkSoft

==================== Find3M ====================

2010-12-02 03:35:18 4280320 ----a-w- c:\windows\system32\GPhotos.scr

2010-11-04 05:52:17 978944 ----a-w- c:\windows\system32\wininet.dll

2010-11-04 05:48:36 44544 ----a-w- c:\windows\system32\licmgr10.dll

2010-11-04 04:41:26 386048 ----a-w- c:\windows\system32\html.iec

2010-11-04 04:08:54 1638912 ----a-w- c:\windows\system32\mshtml.tlb

2010-11-02 04:41:12 351232 ----a-w- c:\windows\system32\wmicmiplugin.dll

2010-11-02 04:40:36 496128 ----a-w- c:\windows\system32\taskschd.dll

2010-11-02 04:40:36 305152 ----a-w- c:\windows\system32\taskcomp.dll

2010-11-02 04:39:32 749056 ----a-w- c:\windows\system32\schedsvc.dll

2010-11-02 04:34:44 192000 ----a-w- c:\windows\system32\taskeng.exe

2010-11-02 04:34:33 179712 ----a-w- c:\windows\system32\schtasks.exe

2010-10-27 04:32:36 2048 ----a-w- c:\windows\system32\tzres.dll

2010-10-20 04:54:18 34304 ----a-w- c:\windows\system32\atmlib.dll

2010-10-20 03:00:24 2327552 ----a-w- c:\windows\system32\win32k.sys

2010-10-20 02:58:41 294400 ----a-w- c:\windows\system32\atmfd.dll

2010-10-16 04:36:10 314368 ----a-w- c:\windows\system32\webio.dll

============= FINISH: 18:46:40,77 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-12-12.01)

Microsoft Windows 7 Ultimate

Boot Device: \Device\HarddiskVolume1

Install Date: 07/07/2010 22:09:07

System Uptime: 09/01/2011 18:32:53 (0 hours ago)

Motherboard: DIGITRON | | G31T-M7

Processor: Intel® Core2 Duo CPU E7500 @ 2.93GHz | CPU 1 | 2936/267mhz

==== Disk Partitions =========================

A: is Removable

C: is FIXED (NTFS) - 233 GiB total, 218,148 GiB free.

D: is FIXED (NTFS) - 233 GiB total, 229,663 GiB free.

E: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================

Adobe Flash Player 10 ActiveX

Adobe Reader 9.3.4 - Português

Ares 2.1.4

Arquivo do WinRAR

Ask.com Search Assistant 1.0.2

Assistente de Conexão do Windows Live

avast! Free Antivirus

Dominó Master 3.3

Ferramenta de Carregamento do Windows Live

Intel® Graphics Media Accelerator Driver

Intel® TV Wizard

Java Auto Updater

Java 6 Update 21

Junk Mail filter update

K-Lite Mega Codec Pack 5.6.1

Messenger Plus! Live

Messenger_Plus_Live_Brazil Toolbar

Microsoft Application Error Reporting

Microsoft Choice Guard

Microsoft Office 2007 Service Pack 2 (SP2)

Microsoft Office Access MUI (Portuguese (Brazil)) 2007

Microsoft Office Enterprise 2007

Microsoft Office Excel MUI (Portuguese (Brazil)) 2007

Microsoft Office Groove MUI (Portuguese (Brazil)) 2007

Microsoft Office InfoPath MUI (Portuguese (Brazil)) 2007

Microsoft Office Live Add-in 1.3

Microsoft Office OneNote MUI (Portuguese (Brazil)) 2007

Microsoft Office Outlook Connector

Microsoft Office Outlook MUI (Portuguese (Brazil)) 2007

Microsoft Office PowerPoint MUI (Portuguese (Brazil)) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (Portuguese (Brazil)) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (Portuguese (Brazil)) 2007

Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

Microsoft Office Publisher MUI (Portuguese (Brazil)) 2007

Microsoft Office Shared MUI (Portuguese (Brazil)) 2007

Microsoft Office Word MUI (Portuguese (Brazil)) 2007

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft XML Parser

MSVCRT

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Nero 8

neroxml

Picasa 3

Security Update for 2007 Microsoft Office System (KB2288621)

Security Update for 2007 Microsoft Office System (KB2288931)

Security Update for 2007 Microsoft Office System (KB2289158)

Security Update for 2007 Microsoft Office System (KB2344875)

Security Update for 2007 Microsoft Office System (KB2345043)

Security Update for 2007 Microsoft Office System (KB969559)

Security Update for 2007 Microsoft Office System (KB976321)

Security Update for Microsoft Office Access 2007 (KB979440)

Security Update for Microsoft Office Excel 2007 (KB2345035)

Security Update for Microsoft Office InfoPath 2007 (KB979441)

Security Update for Microsoft Office PowerPoint 2007 (KB982158)

Security Update for Microsoft Office PowerPoint Viewer (KB2413381)

Security Update for Microsoft Office Publisher 2007 (KB2284697)

Security Update for Microsoft Office system 2007 (972581)

Security Update for Microsoft Office system 2007 (KB974234)

Security Update for Microsoft Office Visio Viewer 2007 (KB973709)

Security Update for Microsoft Office Word 2007 (KB2344993)

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft Office OneNote 2007 (KB980729)

Update for Microsoft Office Outlook 2007 (KB2412171)

Update for Outlook 2007 Junk Email Filter (KB2466076)

VCRedistSetup

Windows Live Call

Windows Live Communications Platform

Windows Live Essentials

Windows Live Galeria de Fotos

Windows Live Mail

Windows Live Messenger

Windows Live Movie Maker

Windows Live Proteção para a Família

Windows Live Sync

==== End Of File ===========================

[RenatoMejias]

Leia atentamente toda a instrução abaixo antes de executar o programa.

Faça download do Kaspersky Removal Tool e salve em seu desktop.

• Instale o programa normalmente, seguindo todas as instruções.
• Uma pasta chamada Virus Removal Tool será criada no desktop.
• Na tela do programa clique nas opções:
  • Meu computador
  • Hidden Startup objects
  • Disk boot sectors
  • System Memory
• Clique no botão Start Scan.
• Seja paciente, o scan é demorado!
• Conforme for scaneando provavelmente abrirá algumas janelas pequenas ao lado do relógio, não clique em nada.
• Também há uma possibilidade de abrir uma janela maior contendo as seguintes opções:
  • Desinfection (quando possível)
  • Delete
  • Skip
• Quando aparecer, marque primero a opção abaixo Apply to all objects e depois clique numa das opções acima.
• Após completar tudo, clique no botão Reports, na janela que abrir nas opções acima deixe:
  • Autoscan
  • Group by result
  • All Events
• Expanda Autoscan clicando no sinal ao lado de +
• Expanda Result: Detected.
• Clique com o botão direito do mouse e escolha Select all, e depois escolha Copy.
• Atenção, ao fazer isso parece que o PC travou, mas não, aguarde uns minutos para liberar a memória.
• Abra o Bloco de Notas e cole (ctrl + v)
• Dê um nome para o arquivo e salve numa pasta de sua preferência.
• Feche o resultado clicando no botão Exit.
• Ao fazer isso será questionado se quer desinstalar a ferramenta, clique em Sim.
• Reinicie o computador quando for pedido.
• Poste o conteúdo desse arquivo em sua próxima resposta.

OBSERVAÇÃO1:

Atente para as janelas durante o scan elas possuem cores diferentes dependendo do risco. Portanto,

• verde
  :
  baixo risco
• amarelo
  :
  médio risco
• vermelho
  :
  alto risco

Antes de tomar qualquer medida verifique com cuidado o caminho/nome do arquivo para ver é de seu conhecimento, caso seja clique em

Skip

.

OBSERVAÇÃO2:

Se no resultado final do scan apenas tiver

Result:

OK

, não precisa gerar um relatório, apenas informe deste.

OBSERVAÇÃO3:

Durante o scan pode ser que o Kaspersky acuse a seguinte pasta com vírus:

c:\

QooBox

. Caso isto aconteça escolha a opção

Skip

, pois a mesma pertence ao

ComboFix

e será removida quando o mesmo for desinstalado.

[Ingrid]

Verificação automática: concluído 7 minutos atrás (eventos: 231727, objetos: 230248, hora: 00:31:39)

Resultado: OK (eventos: 229097)

Resultado: Detectados (eventos: 3)

09/01/2011 22:24:58 C:\Documents and Settings\Ingrid\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\4fe40e53-35cd608e/Comeco.class Ação padrão selecionada

09/01/2011 22:42:55 C:\Windows\System32\Revelation.exe Informações

09/01/2011 22:42:55 C:\Windows\System32\RevelationHelper.dll Informações

Resultado: Arquivar (eventos: 2336)

Resultado: Compactado (eventos: 285)

Resultado: Excluído (eventos: 1)

Resultado: Em backup (eventos: 1)

Resultado: Não processado (eventos: 2)

Resultado: Tarefa iniciada (eventos: 1)

Resultado: Tarefa concluída (eventos: 1)

[RenatoMejias]

Seus logs não apontam infecção. Seus problemas não tem relação com malware.

Para checar o motivo do computador reiniciar, recomendo uma verificação da memória RAM com programa próprio para teste como o MemTest.