hi, my english isn't good but i hope someone can help me.
a few days ago my pc is processing very slwoly, the corel draw program shutdow unexpectly, mozilla firefox and internet explorer are not opening, and sometimes i have to restart the computer because it crashes. So i runned the Spyware Terminator and was listed about 40 problems with the name "Heuristics.Broken.Executable".
I did the scan with HijackThis, and my log was:
Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 17:35:20, on 18/05/11 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal
Running processes: D:\WINDOWS\System32\smss.exe D:\ARQUIV~1\AVG\AVG10\avgchsvx.exe D:\ARQUIV~1\AVG\AVG10\avgrsx.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\nvsvc32.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\spoolsv.exe D:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\AppleMobileDeviceService.exe D:\Arquivos de programas\AVG\AVG10\avgwdsvc.exe D:\Arquivos de programas\Bonjour\mDNSResponder.exe D:\WINDOWS\system32\svchost.exe D:\Arquivos de programas\Borland\Interbase\bin\ibserver.exe D:\Arquivos de programas\Java\jre6\bin\jqs.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\System32\svchost.exe d:\Arquivos de programas\Arquivos comuns\Protexis\License Service\PsiService_2.exe D:\WINDOWS\system32\SnMgrSvc.exe D:\Arquivos de programas\Spyware Terminator\sp_rsser.exe D:\Arquivos de programas\AVG\AVG10\avgnsx.exe D:\WINDOWS\system32\svchost.exe D:\Arquivos de programas\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe D:\WINDOWS\system32\SnAgOS.exe D:\WINDOWS\system32\SnLiveUp.exe D:\WINDOWS\Explorer.exe D:\WINDOWS\RTHDCPL.EXE D:\WINDOWS\system32\RUNDLL32.EXE D:\ARQUIV~1\SPYWAR~1\SpywareTerminatorShield.exe D:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe D:\Arquivos de programas\iTunes\iTunesHelper.exe D:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe D:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe D:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe D:\Arquivos de programas\AVG\AVG10\avgtray.exe D:\Arquivos de programas\Spyware Terminator\SpywareTerminatorUpdate.exe D:\WINDOWS\system32\ctfmon.exe D:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe D:\Arquivos de programas\DAEMON Tools Lite\daemon.exe D:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe D:\Arquivos de programas\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe D:\WINDOWS\system32\wuauclt.exe D:\Arquivos de programas\Internet Explorer\iexplore.exe D:\WINDOWS\system32\wbem\wmiapsrv.exe D:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe D:\Arquivos de programas\iPod\bin\iPodService.exe D:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexStoreSvr.exe D:\Arquivos de programas\Internet Explorer\iexplore.exe D:\WINDOWS\system32\SnEngine.EXE D:\Arquivos de programas\HP\Digital Imaging\bin\hpqSTE08.exe D:\Arquivos de programas\HP\Digital Imaging\bin\hpqbam08.exe D:\Arquivos de programas\Internet Explorer\iexplore.exe D:\Documents and Settings\usuarios\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60446 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60446 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60446 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60446 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60446 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - D:\ARQUIV~1\Crawler\ctbr.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - D:\ARQUIV~1\Crawler\ctbr.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - D:\Arquivos de programas\AVG\AVG10\avgssie.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (file missing) O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Barra de ferramentas &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - D:\ARQUIV~1\Crawler\ctbr.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [nwiz] D:\Arquivos de programas\NVIDIA Corporation\nView\nwiz.exe /installquiet O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SpywareTerminator] "D:\ARQUIV~1\SPYWAR~1\SpywareTerminatorShield.exe" O4 - HKLM\..\Run: [HP Software Update] D:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [QuickTime Task] "D:\Arquivos de programas\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "D:\Arquivos de programas\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [NeroFilterCheck] D:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "D:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [AVG_TRAY] D:\Arquivos de programas\AVG\AVG10\avgtray.exe O4 - HKCU\..\Run: [SpywareTerminatorUpdate] "D:\Arquivos de programas\Spyware Terminator\SpywareTerminatorUpdate.exe" O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "D:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Arquivos de programas\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://D:\WINDOWS\system32\GPhotos.scr/200 O8 - Extra context menu item: Crawler Search - tbr:iemenu O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://D:\ARQUIV~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\ARQUIV~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Arquivos de programas\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Arquivos de programas\Messenger\msmsgs.exe O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp O16 - DPF: {3C8B9651-4E3E-424D-B51C-54544ABF536B} (CAtmCap Object) - https://ww7.banrisul.com.br/bxz/data/securecontrol2k.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - D:\Arquivos de programas\AVG\AVG10\avgpp.dll O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - D:\ARQUIV~1\Crawler\ctbr.dll O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Daemon de cache de categorias de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\system32\browseui.dll O23 - Service: Dispositivo Celular da Apple (Apple Mobile Device) - Apple Inc. - D:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\AppleMobileDeviceService.exe O23 - Service: Autodesk Licensing Service - Autodesk - D:\Arquivos de programas\Arquivos comuns\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - D:\Arquivos de programas\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe O23 - Service: Watchdog do AVG (avgwd) - AVG Technologies CZ, s.r.o. - D:\Arquivos de programas\AVG\AVG10\avgwdsvc.exe O23 - Service: Serviço do Bonjour (Bonjour Service) - Apple Inc. - D:\Arquivos de programas\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - D:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - D:\Arquivos de programas\Google\Update\GoogleUpdate.exe O23 - Service: Serviço do Google Update (gupdatem) (gupdatem) - Google Inc. - D:\Arquivos de programas\Google\Update\GoogleUpdate.exe O23 - Service: Google Updater Service (gusvc) - Google - D:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InterBase Server (InterBaseServer) - Unknown owner - D:\Arquivos.exe (file missing) O23 - Service: iPod Service - Apple Inc. - D:\Arquivos de programas\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Arquivos de programas\Java\jre6\bin\jqs.exe O23 - Service: NBService - Nero AG - D:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - D:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - d:\Arquivos de programas\Arquivos comuns\Protexis\License Service\PsiService_2.exe O23 - Service: SNMgrSvc - Open Communications Security S/A - D:\WINDOWS\system32\SnMgrSvc.exe O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - D:\Arquivos de programas\Spyware Terminator\sp_rsser.exe
µTorrent 32 Bit HP CIO Components Installer Adobe Anchor Service CS3 Adobe Asset Services CS3 Adobe Bridge CS3 Adobe Bridge Start Meeting Adobe Camera Raw 4.0 Adobe CMaps Adobe Color - Photoshop Specific Adobe Color Common Settings Adobe Color EU Extra Settings Adobe Color JA Extra Settings Adobe Color NA Recommended Settings Adobe Default Language CS3 Adobe Device Central CS3 Adobe ExtendScript Toolkit 2 Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Fonts All Adobe Help Viewer CS3 Adobe Illustrator CS3 Adobe Illustrator CS3 Adobe Linguistics CS3 Adobe PDF Library Files Adobe Photoshop CS3 Adobe Photoshop CS3 Adobe Reader 9.4.3 - Português Adobe Setup Adobe Setup Adobe Stock Photos CS3 Adobe Type Support Adobe Update Manager CS3 Adobe Version Cue CS3 Client Adobe WinSoft Linguistics Plugin Adobe XMP Panels CS3 Analysis Bio Apple Application Support Apple Mobile Device Support Apple Software Update Arquivo do WinRAR Artlantis Studio 2 2.0.2 Atheros Communications Inc.(R) L2 Fast Ethernet Driver AutoCAD 2009 - Brasil AVG 2011 AVG 2011 AVG 2011 Bonjour Compatibility Pack for the 2007 Office system Corel Graphics - Windows Shell Extension Corel Graphics - Windows Shell Extension CorelDRAW Graphics Suite X5 - IPM CorelDRAW Graphics Suite X5 - WT CorelDRAW(R) Graphics Suite X5 Crawler Toolbar with Web Security Guard Ferramenta de Carregamento do Windows Live Google Earth Google SketchUp 7.0 to ATL2 Exporter Google SketchUp Pro 7 Google Update Helper High Definition Audio Driver Package - KB888111 Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946040) Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946308) Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946344) Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947540) Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947789) Hotfix para Windows XP (KB942288-v3) HP Customer Participation Program 9.0 HP Imaging Device Functions 9.0 HP OCR Software 9.0 HP Photosmart All-In-One Software 9.0 HP Photosmart Essential 2.01 HP Solution Center 9.0 HP Update HPSSupply IRPF2008 Windows - Declaração de Ajuste Anual iTunes Java(TM) 6 Update 22 Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - PTB Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - PTB Microsoft .NET Framework 3.5 Language Pack SP1 - ptb Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 3.5 SP1 Microsoft Choice Guard Microsoft Office Professional Edição 2003 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual Studio Tools for Applications 2.0 - ENU Microsoft Visual Studio Tools for Applications 2.0 Runtime Mozilla Firefox (3.6.17) MSVCRT MSXML 6.0 Parser (KB925673) Nero 7 Ultra Edition neroxml NVIDIA Display Control Panel NVIDIA Drivers NVIDIA nView Desktop Manager Pacote de Idiomas do Microsoft .NET Framework 3.5 SP1 - PTB PDF Settings Pdf995 Picasa 3 QuickTime Realtek High Definition Audio Driver Segoe UI SLD - Solidariedade SOL-AR Spyware Terminator Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray Windows Internet Explorer 8 Windows Live Call Windows Live Communications Platform Windows Live Essentials Windows Live Essentials Windows Live Messenger Windows Live OneCare safety scanner Windows Media Format Runtime Windows Presentation Foundation Windows XP Service Pack 3 XML Paper Specification Shared Components Language Pack 1.0
*NOTE* CCleaner deletes EVERYTHING out of temp/temporary folders. If you have anything in a temp folder, back it up or move it to a permanent folder prior to running CCleaner!
Download CCleaner from here to clean temp files from your computer.
Double click on the file to start the installation of the program.
Select your language and click OK, then next.
Read the license agreement and click I Agree.
Click next to use the default install location. Click Install then finish to complete installation.
Double click the CCleaner shortcut on the desktop to start the program.
On the "Windows" tab, under "Internet Explorer," uncheck "Cookies" if you do not want them deleted. (If deleted, you will likely need to reenter your passwords at all sites where a cookie is used to recognize you when you visit).
If you use either the Firefox or Mozilla browsers, the box to uncheck for "Cookies" is on the Applications tab, under Firefox/Mozilla.
Click on the "Options" icon at the left side of the window, then click on "Advanced." deselect "Only delete files in Windows Temp folders older than 48 hours."
Click on the "Cleaner" icon on the left side of the window, then click Run Cleaner to run the program.
Caution: It is not recommended that you use the "Issues" feature unless you are very familiar with the registry as it has been known to find legitimate items.
After CCleaner has completed its process, click Exit.
Once done, Reboot, and let me know if we made any progress.
I did everything you said, scan with CCleaner and reboot. The PC still is slow down, other programs are crashing, the autocad for example, and the browsers...
So i downloaded the PCRx to diagnostic for malwares, and was found 1595 errors detected
Tipo de Verificação: Verificação Rápida Objetos escaneados: 169363 Tempo decorrido: 4 minuto(s), 2 segundo(s)
Processos de Memória Infectados: 0 Módulos de Memória Infectados: 0 Chaves de Registro Infectadas: 0 Valores de Registro Infectados: 0 Itens de Dados no Registro Infectados: 3 Pastas Infectadas: 0 Arquivos Infectados: 0
Processos de Memória Infectados: (Não foram detectados ítens maliciosos)
Módulos de Memória Infectados: (Não foram detectados ítens maliciosos)
Chaves de Registro Infectadas: (Não foram detectados ítens maliciosos)
Valores de Registro Infectados: (Não foram detectados ítens maliciosos)
Itens de Dados no Registro Infectados: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Pastas Infectadas: (Não foram detectados ítens maliciosos)
Arquivos Infectados: (Não foram detectados ítens maliciosos)
Sorry but i installed the program in portuguese. The browsers are still with problems, mozilla is not openning and internet explorer crashes, and i have to refresh every second.
Run the TDSSKiller and wait until it finishes (should be just a few seconds or below a minute).. Then find the log at your %systemdrive% (drive that contains Windows)
The log shall be named something like this one..
(TDSSKiller.version_date_time_log) for example.. (TDSSKiller.2.1.1_22.12.2009_19.33.44_log)
bamajim
1 Rookie
•
10376 Posts
784
0
Posted May 19th, 2011 09:00
Copy and paste that list as a reply to this thread