Ir ao conteúdo
  • Cadastre-se
Entre para seguir isso  
charles_bravo_40

Por favor analisem meu log

Recommended Posts

Boa tarde.

O pc está muito lento daí o KASPERSKY ONLINE SCANNER REPORT e fiz o log do HJT, por favor analisem e me ajudem.

Logfile of HijackThis v1.99.1

Scan saved at 08:42:27, on 5/4/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe

C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe

C:\ARQUIV~1\Grisoft\AVG7\avgemc.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe

C:\Arquivos de programas\MSN Messenger\msnmsgr.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\MSN Messenger\usnsvc.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Documents and Settings\Administrador\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://br.msn.com/

R3 - URLSearchHook: CUOLSearchHook Object - {1FE8243E-0A3A-41B9-B9CE-EFFEE51974D3} - C:\Arquivos de programas\Arquivos comuns\uol\urlsearch\UOLSearchHook.dll

R3 - URLSearchHook: Barra de Ferramentas do Yahoo! com bloqueador de pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: ssh2 Class - {2E3C3651-B19C-4DD9-A979-901EC3E930AF} - C:\Arquivos de programas\Scpad\scpsssh2.dll

O2 - BHO: EWPBrowseObject Class - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Arquivos de programas\Canon\Easy-WebPrint\EWPBrowseLoader.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Arquivos de programas\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Arquivos de programas\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Arquivos de programas\Canon\Easy-WebPrint\Toolband.dll

O3 - Toolbar: Barra de Ferramentas do Yahoo! com bloqueador de pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [AVG7_CC] C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe /STARTUP

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\MSN Messenger\msnmsgr.exe" /background

O8 - Extra context menu item: &Windows Live Search - res://C:\Arquivos de programas\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Arquivos de programas\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html

O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Arquivos de programas\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Arquivos de programas\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html

O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Arquivos de programas\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Arquivos de programas\Yahoo!\Common\yinsthelper.dll

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\

O21 - SSODL: CompIBBrd - {A3717295-941D-416F-9384-ED1736729F1C} - C:\Arquivos de programas\Scpad\scpLIB.dll

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgemc.exe

Saturday, April 05, 2008 11:57:16 AM

Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)

Kaspersky Online Scanner version: 5.0.98.0

Kaspersky Anti-Virus database last update: 5/04/2008

Kaspersky Anti-Virus database records: 684126

Scan Settings

Scan using the following antivirus database extended

Scan Archives true

Scan Mail Bases true

Scan Target My Computer

A:\

C:\

D:\

Z:\

Scan Statistics

Total number of scanned objects 65952

Number of viruses found 4

Number of infected objects 7

Number of suspicious objects 0

Duration of the scan process 02:18:22

Infected Object Name Virus Name Last Action

C:\BKLUCIENE\Arquivos de programas\Norton SystemWorks\Norton Antivirus\Quarantine\71D06BA2 Infected: Virus.Win32.Hidrag.a skipped

C:\Criativo\CRIA0017.DAT Object is locked skipped

C:\Criativo\CRIA0018.DAT Object is locked skipped

C:\Criativo\CRIATIVO.STR Object is locked skipped

C:\Criativo\IX010017.X Object is locked skipped

C:\Criativo\IX010018.X Object is locked skipped

C:\Criativo\IX01CRIA.X Object is locked skipped

C:\Criativo\IX020017.X Object is locked skipped

C:\Criativo\IX020018.X Object is locked skipped

C:\Criativo\IX02CRIA.X Object is locked skipped

C:\Criativo\IX030017.X Object is locked skipped

C:\Criativo\IX030018.X Object is locked skipped

C:\Criativo\IX03CRIA.X Object is locked skipped

C:\Criativo\IX040017.X Object is locked skipped

C:\Criativo\IX040018.X Object is locked skipped

C:\Criativo\IX04CRIA.X Object is locked skipped

C:\Criativo\IX050017.X Object is locked skipped

C:\Criativo\IX050018.X Object is locked skipped

C:\Criativo\IX060017.X Object is locked skipped

C:\Criativo\IX060018.X Object is locked skipped

C:\Criativo\IX070017.X Object is locked skipped

C:\Criativo\IX070018.X Object is locked skipped

C:\Criativo\IX080018.X Object is locked skipped

C:\Criativo\IX090018.X Object is locked skipped

C:\Documents and Settings\Administrador\Configura��es locais\Dados de aplicativos\Microsoft\Messenger\tamara.lidercom@hotmail.com\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped

C:\Documents and Settings\Administrador\Configura��es locais\Dados de aplicativos\Microsoft\Messenger\tamara.lidercom@hotmail.com\SharingMetadata\pending.dat Object is locked skipped

C:\Documents and Settings\Administrador\Configura��es locais\Dados de aplicativos\Microsoft\Messenger\tamara.lidercom@hotmail.com\SharingMetadata\Working\database_60C4_79E1_C479_BA3C\dfsr.db Object is locked skipped

C:\Documents and Settings\Administrador\Configura��es locais\Dados de aplicativos\Microsoft\Messenger\tamara.lidercom@hotmail.com\SharingMetadata\Working\database_60C4_79E1_C479_BA3C\fsr.log Object is locked skipped

C:\Documents and Settings\Administrador\Configura��es locais\Dados de aplicativos\Microsoft\Messenger\tamara.lidercom@hotmail.com\SharingMetadata\Working\database_60C4_79E1_C479_BA3C\fsrtmp.log Object is locked skipped

C:\Documents and Settings\Administrador\Configura��es locais\Dados de aplicativos\Microsoft\Messenger\tamara.lidercom@hotmail.com\SharingMetadata\Working\database_60C4_79E1_C479_BA3C\tmp.edb Object is locked skipped

C:\Documents and Settings\Administrador\Configura��es locais\Dados de aplicativos\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\Administrador\Configura��es locais\Dados de aplicativos\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\Administrador\Configura��es locais\Dados de aplicativos\Microsoft\Windows Live Contacts\tamara.lidercom@hotmail.com\real\members.stg Object is locked skipped

C:\Documents and Settings\Administrador\Configura��es locais\Hist�rico\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Administrador\Configura��es locais\Temp\~DF8104.tmp Object is locked skipped

C:\Documents and Settings\Administrador\Configura��es locais\Temp\~DF813C.tmp Object is locked skipped

C:\Documents and Settings\Administrador\Configura��es locais\Temporary Internet Files\Content.IE5\8HMBOTI3\KB155-en--Troubleshooting-BitDefender-Online-Scanner[1].html Object is locked skipped

C:\Documents and Settings\Administrador\Configura��es locais\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Administrador\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\Administrador\ntuser.dat Object is locked skipped

C:\Documents and Settings\Administrador\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\All Users\Dados de aplicativos\Avg7\Log\emc.log Object is locked skipped

C:\Documents and Settings\All Users\Dados de aplicativos\Grisoft\Avg7Data\avg7log.log Object is locked skipped

C:\Documents and Settings\All Users\Dados de aplicativos\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped

C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\LocalService\Configura��es locais\Dados de aplicativos\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Configura��es locais\Dados de aplicativos\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Configura��es locais\Hist�rico\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Configura��es locais\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Configura��es locais\Dados de aplicativos\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Configura��es locais\Dados de aplicativos\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Configura��es locais\Hist�rico\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Configura��es locais\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{0F8C37E8-3C48-47A5-9C1D-7F12D7006462}\RP425\A0110343.exe Object is locked skipped

C:\System Volume Information\_restore{0F8C37E8-3C48-47A5-9C1D-7F12D7006462}\RP425\A0110344.exe Object is locked skipped

C:\System Volume Information\_restore{0F8C37E8-3C48-47A5-9C1D-7F12D7006462}\RP425\A0110345.exe Object is locked skipped

C:\System Volume Information\_restore{0F8C37E8-3C48-47A5-9C1D-7F12D7006462}\RP425\A0110346.EXE Object is locked skipped

C:\System Volume Information\_restore{0F8C37E8-3C48-47A5-9C1D-7F12D7006462}\RP425\A0110347.exe Object is locked skipped

C:\System Volume Information\_restore{0F8C37E8-3C48-47A5-9C1D-7F12D7006462}\RP425\A0110348.exe Object is locked skipped

C:\System Volume Information\_restore{0F8C37E8-3C48-47A5-9C1D-7F12D7006462}\RP426\A0110843.exe/data.rar/xpkey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped

C:\System Volume Information\_restore{0F8C37E8-3C48-47A5-9C1D-7F12D7006462}\RP426\A0110843.exe/data.rar/officekey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped

C:\System Volume Information\_restore{0F8C37E8-3C48-47A5-9C1D-7F12D7006462}\RP426\A0110843.exe/data.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped

C:\System Volume Information\_restore{0F8C37E8-3C48-47A5-9C1D-7F12D7006462}\RP426\A0110843.exe RarSFX: infected - 3 skipped

C:\System Volume Information\_restore{0F8C37E8-3C48-47A5-9C1D-7F12D7006462}\RP442\change.log Object is locked skipped

C:\WINDOWS\00001\0007.jpg Infected: Trojan-Spy.Win32.Banbra.abv skipped

C:\WINDOWS\00001\0009.jpg Infected: Trojan-Spy.Win32.Banbra.aaj skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Z:\AKDABOCK Object is locked skipped

Z:\ALBKCEFK Object is locked skipped

Z:\CRIA0017.DAT Object is locked skipped

Z:\CRIA0030.DAT Object is locked skipped

Z:\CRIA0036.DAT Object is locked skipped

Z:\CRIA0037.DAT Object is locked skipped

Z:\CRIATIVO.STR Object is locked skipped

Z:\IX010017.X Object is locked skipped

Z:\IX010030.X Object is locked skipped

Z:\IX010031.X Object is locked skipped

Z:\IX010032.X Object is locked skipped

Z:\IX01CRIA.X Object is locked skipped

Z:\IX020017.X Object is locked skipped

Z:\IX020030.X Object is locked skipped

Z:\IX020031.X Object is locked skipped

Z:\IX020032.X Object is locked skipped

Z:\IX02CRIA.X Object is locked skipped

Z:\IX030017.X Object is locked skipped

Z:\IX030030.X Object is locked skipped

Z:\IX030031.X Object is locked skipped

Z:\IX030032.X Object is locked skipped

Z:\IX03CRIA.X Object is locked skipped

Z:\IX040017.X Object is locked skipped

Z:\IX040030.X Object is locked skipped

Z:\IX040031.X Object is locked skipped

Z:\IX040032.X Object is locked skipped

Z:\IX04CRIA.X Object is locked skipped

Z:\IX050017.X Object is locked skipped

Z:\IX050030.X Object is locked skipped

Z:\IX050031.X Object is locked skipped

Z:\IX050032.X Object is locked skipped

Z:\IX060017.X Object is locked skipped

Z:\IX060030.X Object is locked skipped

Z:\IX060031.X Object is locked skipped

Z:\IX060032.X Object is locked skipped

Z:\IX070017.X Object is locked skipped

Z:\IX070030.X Object is locked skipped

Z:\IX070031.X Object is locked skipped

Z:\IX070032.X Object is locked skipped

Z:\IX080017.X Object is locked skipped

Z:\IX080030.X Object is locked skipped

Z:\IX080031.X Object is locked skipped

Z:\IX080032.X Object is locked skipped

Z:\IX090030.X Object is locked skipped

Z:\IX090031.X Object is locked skipped

Z:\IX090032.X Object is locked skipped

Z:\IX100031.X Object is locked skipped

Z:\IX100032.X Object is locked skipped

Scan process completed.

Agradeço antecipadamente.

Compartilhar este post


Link para o post
Compartilhar em outros sites

- Apague a pasta em destaque:

C:\WINDOWS\00001

- No mais, o log está limpo :)

- Atualize o Internet Explorer:

http://www.microsoft.com/downloads/details.aspx?FamilyId=9AE91EBE-3385-447C-8A30-081805B2F90B&displaylang=pt-br

- Recomendo uma manutenção no computador para exclusão dos arquivos temporários, desnecessários e entradas inválidas no registro. Faça o download do CCleaner:

  • Abra o programa e clique em Executar Limpeza;
  • Após isto, clique em Registro > Procurar erros > Corrigir erros selecionados

- Desative e ative novamente a Restauração do Sistema

- Leia o artigo Proteja seu PC para mais informações sobre como evitar infecções.

Compartilhar este post


Link para o post
Compartilhar em outros sites
Entre para seguir isso  





Sobre o Clube do Hardware

No ar desde 1996, o Clube do Hardware é uma das maiores, mais antigas e mais respeitadas publicações sobre tecnologia do Brasil. Leia mais

Direitos autorais

Não permitimos a cópia ou reprodução do conteúdo do nosso site, fórum, newsletters e redes sociais, mesmo citando-se a fonte. Leia mais

×