[Resolvido!]Trojan-Spy.Win32@mx

[ThiHenrique 0]

:( aaaa vi que precisa passar o hijack entao...ta aiiiRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exeC:\WINDOWS\System32\cisvc.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\Arquivos de programas\Key Generator\isamonitor.exeC:\Arquivos de programas\Key Generator\pmsngr.exeC:\Arquivos de programas\MSN Messenger\msnmsgr.exeC:\Arquivos de programas\Key Generator\isamini.exeC:\Arquivos de programas\Key Generator\pmmon.exeC:\Arquivos de programas\MSN Messenger\usnsvc.exeC:\WINDOWS\System32\cidaemon.exeD:\Arquivos de programas\Mozilla Firefox\firefox.exeD:\Aplicativos\HijackThis.exeO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar1.dllO4 - HKLM\..\Run: [Arovax AntiSpyware] D:\Arquivos de programas\Arovax AntiSpyware\arovaxantispyware.exe /sO4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\MSN Messenger\msnmsgr.exe" /backgroundO17 - HKLM\System\CCS\Services\Tcpip\..\{9801110F-2CFA-4292-8EFF-0B3A02F63649}: NameServer = 192.168.254.254O17 - HKLM\System\CS1\Services\Tcpip\..\{9801110F-2CFA-4292-8EFF-0B3A02F63649}: NameServer = 192.168.254.254O17 - HKLM\System\CS2\Services\Tcpip\..\{9801110F-2CFA-4292-8EFF-0B3A02F63649}: NameServer = 192.168.254.254O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exeabraços espero ajuda..e agradeço mui a todos..thi

[jgarcia 1]

Opa ThiHenrique,

 

O log parece ter sido gerado em Modo Seguro.

 

É preciso que você poste um log gerado em Modo Normal, inclusive o cabeçalho.

 

Abraços.

[ThiHenrique 0]

Logfile of HijackThis v1.99.1Scan saved at 14:26:01, on 30/11/2006Platform: Windows XP (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exeC:\WINDOWS\System32\cisvc.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\Arquivos de programas\Key Generator\isamonitor.exeC:\Arquivos de programas\Key Generator\pmsngr.exeC:\Arquivos de programas\MSN Messenger\msnmsgr.exeC:\Arquivos de programas\Key Generator\isamini.exeC:\Arquivos de programas\Key Generator\pmmon.exeC:\Arquivos de programas\MSN Messenger\usnsvc.exeC:\WINDOWS\System32\cidaemon.exeD:\Arquivos de programas\NtreevSoft\PangYa\update_br.clnD:\Arquivos de programas\real\realplay.exeC:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exeD:\Arquivos de programas\Mozilla Firefox\firefox.exeD:\Aplicativos\HijackThis.exeO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar1.dllO4 - HKLM\..\Run: [Arovax AntiSpyware] D:\Arquivos de programas\Arovax AntiSpyware\arovaxantispyware.exe /sO4 - HKLM\..\Run: [TkBellExe] "C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osbootO4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\MSN Messenger\msnmsgr.exe" /backgroundO17 - HKLM\System\CCS\Services\Tcpip\..\{9801110F-2CFA-4292-8EFF-0B3A02F63649}: NameServer = 192.168.254.254O17 - HKLM\System\CS1\Services\Tcpip\..\{9801110F-2CFA-4292-8EFF-0B3A02F63649}: NameServer = 192.168.254.254O17 - HKLM\System\CS2\Services\Tcpip\..\{9801110F-2CFA-4292-8EFF-0B3A02F63649}: NameServer = 192.168.254.254O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exeolha ai c cabecalho..e talzvlw...

[jgarcia 1]

Opa ThiHenrique,

 

1. Baixe o SmitfraudFix;

 

2. Desabilite a proteção do seu anti-vírus (temporariamente);

 

3. Extraia o arquivo SmitFraudFix para o seu desktop;

 

4. Execute o SmitfraudFix dando um duplo clique sobre smitfraudfix.cmd --> escolha a Opção 1;

 

5. Poste o log gerado pelo SmitfraudFix (opção 1).

 

Aguardo breve retorno.

 

Abraços.

[ThiHenrique 0]

Ei acho q fiz tudo certo..ve se era assim mesmo p fikabraçoSmitFraudFix v2.126Scan done at 22:20:03,64, qui 30/11/2006Run from C:\Documents and Settings\Thi Henrique\Desktop\SmitfraudFixOS: Microsoft Windows XP [versÆo 5.1.2600] - Windows_NTFix run in safe mode»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix!!!Attention, following keys are not inevitably infected!!!SrchSTS.exe by S!RiSearch SharedTaskScheduler's .dll»»»»»»»»»»»»»»»»»»»»»»»» Killing process»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos FixGenericRenosFix by S!Ri»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix!!!Attention, following keys are not inevitably infected!!!SrchSTS.exe by S!RiSearch SharedTaskScheduler's .dll»»»»»»»»»»»»»»»»»»»»»»»» EndLogfile of HijackThis v1.99.1Scan saved at 22:22:20, on 30/11/2006Platform: Windows XP (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\ZoneLabs\vsmon.exeC:\WINDOWS\system32\spoolsv.exeC:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exeC:\WINDOWS\System32\cisvc.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXED:\Aplicativos\HijackThis.exeO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar1.dllO17 - HKLM\System\CCS\Services\Tcpip\..\{9801110F-2CFA-4292-8EFF-0B3A02F63649}: NameServer = 192.168.254.254O17 - HKLM\System\CS1\Services\Tcpip\..\{9801110F-2CFA-4292-8EFF-0B3A02F63649}: NameServer = 192.168.254.254O17 - HKLM\System\CS2\Services\Tcpip\..\{9801110F-2CFA-4292-8EFF-0B3A02F63649}: NameServer = 192.168.254.254O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exedesde ja agradeço muito

[jgarcia 1]

Opa ThiHenrique,

 

Poste um log do HijackThis gerado em Modo Normal.

 

Abraços.

[ThiHenrique 0]

esta ai acima ..

[jgarcia 1]

Opa ThiHenrique,

 

Não há entradas anormais em seu log. O problema persiste?

[ThiHenrique 0]

Nao o problema foi resolvido...agradeçothi

[jgarcia 1]

PROBLEMA RESOLVIDO!

 

Caso o autor necessite que o tópico seja reaberto é necessário enviar uma Mensagem Privada para um Moderador com um link para o tópico.