Publicado em 7 de jan.

[Resolvido!] Micro infectado com Win32:Rottkit-gen(Rtk)

#topicos-resolvidos-seguranca-malwares

Olá,

segue log do Hijack, agradeço desde já pela ajuda.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:57:51, on 6/1/2009

Platform: Windows 2000 SP4 (WinNT 5.00.2195)

MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)

Boot mode: Normal

Running processes:

C:\WINNT\System32\smss.exe

C:\WINNT\system32\winlogon.exe

C:\WINNT\system32\services.exe

C:\WINNT\system32\lsass.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\system32\spoolsv.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINNT\System32\svchost.exe

C:\WINNT\system32\regsvc.exe

C:\WINNT\System32\WBEM\WinMgmt.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\Explorer.EXE

C:\Arquivos de programas\Trend Micro\PC-cillin 2002\PCCPFW.exe

C:\Arquivos de programas\Trend Micro\PC-cillin 2002\PCCClient.exe

C:\Arquivos de programas\Trend Micro\PC-cillin 2002\Pop3trap.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINNT\system32\explorer.exe

C:\WINNT\system32\csrs.exe

C:\WINNT\system32\internat.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\Arquivos de programas\Mobile Partner\Mobile Partner.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.mozilla.org/

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: @msdxmLC.dll,-1@1046,&Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx

O3 - Toolbar: Barra de Ferramentas do Yahoo! com bloqueador de pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [synchronization Manager] mobsync.exe /logon

O4 - HKLM\..\Run: [pccguide.exe] "C:\Arquivos de programas\Trend Micro\PC-cillin 2002\pccguide.exe"

O4 - HKLM\..\Run: [PCCClient.exe] "C:\Arquivos de programas\Trend Micro\PC-cillin 2002\PCCClient.exe"

O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Arquivos de programas\Trend Micro\PC-cillin 2002\Pop3trap.exe"

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [Windows Explorer] C:\WINNT\system32\explorer.exe

O4 - HKLM\..\Run: [Client Server Runtime Process] C:\WINNT\system32\csrs.exe

O4 - HKCU\..\Run: [internat.exe] internat.exe

O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Arquivos de programas\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O14 - IERESET.INF: START_PAGE_URL=http://www.msn.com.br

O14 - IERESET.INF: MS_START_PAGE_URL=http://www.msn.com.br

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - [http://www.update.microsoft.com/windowsupd...b?1230736796784](http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1230736796784)

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - [http://update.microsoft.com/microsoftupdat...b?1230737648629](http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1230737648629)

O17 - HKLM\System\CCS\Services\Tcpip\..\{8F87C3BA-776D-4EBE-83DF-7827FC401D0A}: NameServer = 200.169.117.22 200.169.119.22

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Serviço administrativo do gerenciador de disco lógico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe

O23 - Service: PC-cillin PersonalFirewall (PCCPFW) - Trend Micro Inc. - C:\Arquivos de programas\Trend Micro\PC-cillin 2002\PCCPFW.exe

O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - C:\Arquivos de programas\Trend Micro\PC-cillin 2002\Tmntsrv.exe

End of file - 4520 bytes

Discussão (9)

Entre ou cadastre-se para participar da discussão

Entrar Criar conta

MGuitar· 7 de jan.

- Faça o download do [KillBox](http://www.killbox.net/downloads/beta/KillBox.exe) crie uma pasta própria para a ferramenta em C: e salve-o dentro da pasta criada;

 

● Execute o *KillBox* e marque a opção **Delete on Reboot**;

● Selecione todo o texto aqui abaixo e copie-o (Ctrl + C):

>
C:\WINNT\system32\explorer.exeC:\WINNT\system32\csrs.exe

● Volte ao *KillBox*, clique no menu **File** > **Paste from Clipboard**;

● Clique no botão **All Files**;

● Clique no botão /applications/core/interface/imageproxy/imageproxy.php?img=http://www.linhadefensiva.org/forum/help/killbox.png&key=190df575176c46d9a76b9f9b20ee6a31be716126f2f52da7ca017950160a91cd" alt="killbox.png" /> e ao ser perguntado **Reboot Now**? Confirme e reinicie seu computador em **Modo de Segurança** (segurando a tecla F8 na inicialização do sistema e escolhendo Modo Seguro);

● Já em Modo Seguro, execute o HijackThis e clique em Do a system scan only. Marque as entradas abaixo e clique no botão /applications/core/interface/imageproxy/imageproxy.php?img=http://img510.imageshack.us/img510/4779/imagemwz3.jpg&key=db557bde5eb9079550430eed5c837956d07bc082d180a6863598dd1a04eb83f7" alt="imagemwz3.jpg" />.

O4 - HKLM\..\Run: [Windows Explorer] C:\WINNT\system32\explorer.exeO4 - HKLM\..\Run: [Client Server Runtime Process] C:\WINNT\system32\csrs.exe

Em sua próxima resposta, cole um novo log do HijackThis.

Annluciap· 8 de jan.

Olá,

segui as instruções, só não consegui excluir a entrada do "explore.exe".

Abaixo está log do hijack.

Obrigada de novo.

***********************************

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 01:25:52, on 8/1/2009

Platform: Windows 2000 SP4 (WinNT 5.00.2195)

MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)

Boot mode: Safe mode

Running processes:

C:\WINNT\System32\smss.exe

C:\WINNT\system32\winlogon.exe

C:\WINNT\system32\services.exe

C:\WINNT\system32\lsass.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\System32\WBEM\WinMgmt.exe

C:\WINNT\system32\userinit.exe