[Resolvido] erro ibm00001.exe

indianw · Fevereiro 12, 2006

Ois

Quando inicio o PC aparece um erro: inexistência do ficheiro ibm0001.exe.

li os vossos tópicos anteriores acerca de erros iguais e fiz o download do Hijackthis versão 1.99.1 e obtive o seguinte log:

Logfile of HijackThis v1.99.1

Scan saved at 15:33:46, on 12-02-2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

I:\WINDOWS\System32\smss.exe

I:\WINDOWS\system32\winlogon.exe

I:\WINDOWS\system32\services.exe

I:\WINDOWS\system32\lsass.exe

I:\WINDOWS\system32\Ati2evxx.exe

I:\WINDOWS\system32\svchost.exe

I:\WINDOWS\System32\svchost.exe

I:\Programas\Ficheiros comuns\Symantec Shared\ccSetMgr.exe

I:\Programas\Ficheiros comuns\Symantec Shared\SNDSrvc.exe

I:\Programas\Ficheiros comuns\Symantec Shared\SPBBC\SPBBCSvc.exe

I:\Programas\Ficheiros comuns\Symantec Shared\ccEvtMgr.exe

I:\WINDOWS\system32\spoolsv.exe

I:\WINDOWS\system32\Ati2evxx.exe

I:\WINDOWS\explorer.exe

I:\WINDOWS\RTHDCPL.EXE

I:\Programas\CyberLink\PowerDVD\PDVDServ.exe

I:\WINDOWS\system32\rundll32.exe

I:\Programas\Ficheiros comuns\Symantec Shared\ccApp.exe

I:\Programas\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

I:\Programas\Microsoft AntiSpyware\gcasServ.exe

I:\WINDOWS\system32\rundll32.exe

I:\WINDOWS\system32\ctfmon.exe

I:\Programas\Creative\MediaSource\Detector\CTDetect.exe

I:\Programas\IVT Corporation\BlueSoleil\BlueSoleil.exe

I:\Programas\Norton SystemWorks\Norton GoBack\GBTray.exe

I:\Programas\Nokia\PC Suite for Nokia 6600\connmngmntbox.exe

I:\Programas\Nokia\PC Suite for Nokia 6600\ectaskscheduler.exe

I:\Programas\Marktest\NetPanel\NETPANEL.EXE

I:\Programas\Intuwave\Shared\mRouterRunTime\mRouterRuntime.exe

I:\PROGRA~1\Nokia\PCSUIT~1\Elogerr.exe

I:\Programas\Microsoft AntiSpyware\gcasDtServ.exe

I:\Programas\IVT Corporation\BlueSoleil\BTNtService.exe

I:\PROGRA~1\Nokia\PCSUIT~1\BROADC~1.EXE

I:\WINDOWS\system32\CTsvcCDA.EXE

I:\Programas\Norton SystemWorks\Norton GoBack\GBPoll.exe

I:\PROGRA~1\Nokia\PCSUIT~1\SCRFS.exe

I:\Programas\Ficheiros comuns\LightScribe\LSSrvc.exe

I:\Programas\Ficheiros comuns\Microsoft Shared\VS7Debug\mdm.exe

I:\Programas\Norton SystemWorks\Norton AntiVirus\navapsvc.exe

I:\Programas\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe

I:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE

I:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE

I:\WINDOWS\system32\svchost.exe

I:\Programas\Ficheiros comuns\Symantec Shared\CCPD-LC\symlcsvc.exe

I:\Programas\MSN Messenger\msnmsgr.exe

I:\Programas\Messenger\msmsgs.exe

I:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.pt

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.pt

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hiperligações

F2 - REG:system.ini: Shell=explorer.exe "I:\Programas\Ficheiros comuns\Microsoft Shared\Web Folders\ibm00001.exe"

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - I:\Programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - I:\Programas\Norton SystemWorks\Norton AntiVirus\NavShExt.dll

O2 - BHO: IE Panel, Marktest 2000 - {EBCE37F5-7503-4645-845D-D8F197BB1A4D} - I:\Programas\Marktest\NetPanel\IEPainel.DLL

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - I:\Programas\Norton SystemWorks\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - I:\Programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [RemoteControl] I:\Programas\CyberLink\PowerDVD\PDVDServ.exe

O4 - HKLM\..\Run: [NeroFilterCheck] I:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar

O4 - HKLM\..\Run: [ccApp] "I:\Programas\Ficheiros comuns\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "I:\Programas\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

O4 - HKLM\..\Run: [symantec NetDriver Monitor] I:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer

O4 - HKLM\..\Run: [gcasServ] "I:\Programas\Microsoft AntiSpyware\gcasServ.exe"

O4 - HKLM\..\Run: [NetPanel] I:\Programas\Marktest\NetPanel\NOLWizz.exe

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKCU\..\Run: [ctfmon.exe] I:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Creative Detector] I:\Programas\Creative\MediaSource\Detector\CTDetect.exe /R

O4 - Startup: Adobe Gamma.lnk = I:\Programas\Ficheiros comuns\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?

O4 - Global Startup: BlueSoleil.lnk = ?

O4 - Global Startup: Microsoft Office.lnk = I:\Programas\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: Norton GoBack.lnk = I:\Programas\Norton SystemWorks\Norton GoBack\GBTray.exe

O4 - Global Startup: PCSuiteForNokia6600 Detect.lnk = ?

O4 - Global Startup: PCSuiteForNokia6600 TS.lnk = ?

O8 - Extra context menu item: Convert link target to Adobe PDF - res://I:\Programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://I:\Programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://I:\Programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://I:\Programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://I:\Programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://I:\Programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://I:\Programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert to existing PDF - res://I:\Programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://I:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: NetPanel - {9C13F363-C6B1-11D4-9DD8-004F4E01AB12} - I:\Programas\Marktest\NetPanel\NP-Users.exe

O9 - Extra 'Tools' menuitem: NetPanel - {9C13F363-C6B1-11D4-9DD8-004F4E01AB12} - I:\Programas\Marktest\NetPanel\NP-Users.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Programas\Messenger\msmsgs.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwa...ash/swflash.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "I:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O23 - Service: Adobe LM Service - Adobe Systems - I:\Programas\Ficheiros comuns\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - I:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - I:\WINDOWS\system32\ati2sgag.exe

O23 - Service: BlueSoleil Hid Service - Unknown owner - I:\Programas\IVT Corporation\BlueSoleil\BTNtService.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - I:\Programas\Ficheiros comuns\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - I:\Programas\Ficheiros comuns\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - I:\Programas\Ficheiros comuns\Symantec Shared\ccSetMgr.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - I:\WINDOWS\system32\CTsvcCDA.EXE

O23 - Service: GoBack Polling Service (GBPoll) - Symantec Corporation - I:\Programas\Norton SystemWorks\Norton GoBack\GBPoll.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - I:\Programas\Ficheiros comuns\LightScribe\LSSrvc.exe

O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - I:\Programas\Norton SystemWorks\Norton AntiVirus\navapsvc.exe

O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - I:\Programas\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe

O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - I:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE

O23 - Service: SAVScan - Symantec Corporation - I:\Programas\Norton SystemWorks\Norton AntiVirus\SAVScan.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - I:\PROGRA~1\FICHEI~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - I:\Programas\Ficheiros comuns\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - I:\Programas\Ficheiros comuns\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Speed Disk service - Symantec Corporation - I:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE

O23 - Service: Symantec Core LC - Symantec Corporation - I:\Programas\Ficheiros comuns\Symantec Shared\CCPD-LC\symlcsvc.exe

Precisava da vossa ajuda para resolver o problema.

muito obrigada

jgarcia · Fevereiro 12, 2006

Cara indianw,

Baixe o SmitfraudFix.

Desabilite a proteção do seu anti-vírus (temporariamente).

Extraia o arquivo SmitFraudFix para o seu desktop.

Dê duplo-clique no smitfraudfix.cmd.

Escolha a opção 1, aguarde o scan acabar e poste o log gerado.

Abraços.

indianw · Fevereiro 12, 2006

SmitFraudFix v2.19Rapport fait à 20:08:21,94 le 12-02-2006Executé à partir de I:\Documents and Settings\Proprietario\Ambiente de trabalho\SmitfraudFixOS: Microsoft Windows XP [VersÆo 5.1.2600]»»»»»»»»»»»»»»»»»»»»»»»» Recherche I:\»»»»»»»»»»»»»»»»»»»»»»»» Recherche I:\WINDOWSI:\WINDOWS\secure32.html PRESENT !I:\WINDOWS\tool1.exe PRESENT !I:\WINDOWS\tool4.exe PRESENT !»»»»»»»»»»»»»»»»»»»»»»»» Recherche I:\WINDOWS\system»»»»»»»»»»»»»»»»»»»»»»»» Recherche I:\WINDOWS\Web»»»»»»»»»»»»»»»»»»»»»»»» Recherche I:\WINDOWS\system32I:\WINDOWS\system32\paradise.raw.exe PRESENT !»»»»»»»»»»»»»»»»»»»»»»»» Recherche I:\WINDOWS\system32\LogFiles»»»»»»»»»»»»»»»»»»»»»»»» Recherche ...\Application DataI:\Documents and Settings\Proprietario\Application Data\Install.dat PRESENT !»»»»»»»»»»»»»»»»»»»»»»»» Recherche Menu Démarrer»»»»»»»»»»»»»»»»»»»»»»»» Recherche Bureau»»»»»»»»»»»»»»»»»»»»»»»» Recherche I:\Programas »»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de clés corrompues»»»»»»»»»»»»»»»»»»»»»»»» Recherche éléments du bureau [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]"Source"="About:Home""SubscribedURL"="About:Home""FriendlyName"="A minha home page actual" »»»»»»»»»»»»»»»»»»»»»»»» Recherche SharedtaskschedulerSrchSTS.exe by S!RiSearch SharedTaskScheduler's .dll[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-carregador Browseui"[HKEY_CLASSES_ROOT\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]@="%SystemRoot%\system32\browseui.dll"[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]@="%SystemRoot%\system32\browseui.dll"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Daemon da cache de categorias dos componentes"[HKEY_CLASSES_ROOT\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]@="%SystemRoot%\system32\browseui.dll"[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]@="%SystemRoot%\system32\browseui.dll"»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapportobrigada

jgarcia · Fevereiro 12, 2006

Cara indianw,

Agora você deve:

1. Reiniciar em Modo Seguro;

2. Executar o SmitfraudFix --> Opção 2;

3. Responder sim (o) à pergunta sobre a limpeza do registro;

4. Aguardar o término do scan e a geração do log;

5. Reiniciar em Modo Normal;

6. Postar o log do SmitfraudFix (opção 2) + log HijackThis (em Modo Normal).

Abraços.

indianw · Fevereiro 18, 2006

Ois!!

Peço desculpa mas estive ausente durante estes dias aqui vai os logs:

log do SmitfraudFix (opção 2)

SmitFraudFix v2.19

Rapport fait à 23:12:33,17 le 18-02-2006

Executé à partir de I:\Documents and Settings\Proprietario\Ambiente de trabalho\arranjo pc\SmitfraudFix

OS: Microsoft Windows XP [VersÆo 5.1.2600]

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

I:\WINDOWS\secure32.html supprimé

I:\WINDOWS\tool1.exe supprimé

I:\WINDOWS\tool4.exe supprimé

I:\WINDOWS\system32\paradise.raw.exe supprimé

I:\Documents and Settings\Proprietario\Application Data\Install.dat supprimé

»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage Fichiers Temporaires

»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

Nettoyage terminé.

»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport

log HijackThis (em Modo Normal)

Logfile of HijackThis v1.99.1

Scan saved at 23:16:51, on 18-02-2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

I:\WINDOWS\System32\smss.exe

I:\WINDOWS\system32\winlogon.exe

I:\WINDOWS\system32\services.exe

I:\WINDOWS\system32\lsass.exe

I:\WINDOWS\system32\Ati2evxx.exe

I:\WINDOWS\system32\svchost.exe

I:\WINDOWS\System32\svchost.exe

I:\Programas\Ficheiros comuns\Symantec Shared\ccSetMgr.exe

I:\Programas\Ficheiros comuns\Symantec Shared\SNDSrvc.exe

I:\Programas\Ficheiros comuns\Symantec Shared\SPBBC\SPBBCSvc.exe

I:\Programas\Ficheiros comuns\Symantec Shared\ccEvtMgr.exe

I:\WINDOWS\system32\spoolsv.exe

I:\WINDOWS\system32\Ati2evxx.exe

I:\WINDOWS\explorer.exe

I:\WINDOWS\RTHDCPL.EXE

I:\Programas\CyberLink\PowerDVD\PDVDServ.exe

I:\WINDOWS\system32\rundll32.exe

I:\Programas\Ficheiros comuns\Symantec Shared\ccApp.exe

I:\Programas\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

I:\Programas\Microsoft AntiSpyware\gcasServ.exe

I:\WINDOWS\system32\rundll32.exe

I:\WINDOWS\system32\ctfmon.exe

I:\Programas\Creative\MediaSource\Detector\CTDetect.exe

I:\Programas\IVT Corporation\BlueSoleil\BlueSoleil.exe

I:\Programas\Norton SystemWorks\Norton GoBack\GBTray.exe

I:\Programas\Nokia\PC Suite for Nokia 6600\connmngmntbox.exe

I:\Programas\Nokia\PC Suite for Nokia 6600\ectaskscheduler.exe

I:\Programas\Marktest\NetPanel\NETPANEL.EXE

I:\Programas\Intuwave\Shared\mRouterRunTime\mRouterRuntime.exe

I:\PROGRA~1\Nokia\PCSUIT~1\Elogerr.exe

I:\Programas\Microsoft AntiSpyware\gcasDtServ.exe

I:\Programas\IVT Corporation\BlueSoleil\BTNtService.exe

I:\PROGRA~1\Nokia\PCSUIT~1\BROADC~1.EXE

I:\WINDOWS\system32\CTsvcCDA.EXE

I:\Programas\Norton SystemWorks\Norton GoBack\GBPoll.exe

I:\Programas\Ficheiros comuns\LightScribe\LSSrvc.exe

I:\Programas\Ficheiros comuns\Microsoft Shared\VS7Debug\mdm.exe

I:\Programas\Norton SystemWorks\Norton AntiVirus\navapsvc.exe

I:\Programas\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe

I:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE

I:\PROGRA~1\Nokia\PCSUIT~1\SCRFS.exe

I:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE

I:\WINDOWS\system32\svchost.exe

I:\Programas\Ficheiros comuns\Symantec Shared\CCPD-LC\symlcsvc.exe

I:\Programas\Messenger\msmsgs.exe

I:\WINDOWS\system32\wuauclt.exe