[Resolvido!]Analisem meu log

Nilson N · Maio 30, 2007

Logfile of HijackThis v1.99.1

Scan saved at 11:37:15, on 30/5/2007

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\msnmessangern.exe

C:\Arquivos de programas\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe

C:\Arquivos de programas\SiteAdvisor\6066\SAService.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\WgaTray.exe

C:\ARQUIV~1\ASSIST~1\SMARTB~1\MotiveSB.exe

C:\Arquivos de programas\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe

C:\Arquivos de programas\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe

C:\Arquivos de programas\SiteAdvisor\6066\SiteAdv.exe

C:\WINDOWS\System32\NSecurity.exe

C:\WINDOWS\System32\absecure32.exe

C:\WINDOWS\System32\ctfmon.exe

C:\Arquivos de programas\Assistente Tecnico Speedy\bin\mpbtn.exe

C:\WINDOWS\System32\wuauclt.exe

C:\Arquivos de programas\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAV.exe

C:\Arquivos de programas\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\WINDOWS\System32\msiexec.exe

C:\WINDOWS\system32\notepad.exe

C:\Arquivos de programas\Orbitdownloader\orbitnet.exe

C:\Arquivos de programas\UPHClean\uphclean.exe

C:\Arquivos de programas\Orbitdownloader\orbitdm.exe

C:\hijackthis\HijackThis.exe

C:\WINDOWS\system32\ntvdm.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.igbandalarga.com.br/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1

O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Arquivos de programas\Orbitdownloader\orbitcth.dll

O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Arquivos de programas\SiteAdvisor\6066\SiteAdv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: IE Assistant - {B08D32DE-64B2-4137-8345-87293E70D40B} - C:\WINDOWS\System32\iea.dll

O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Arquivos de programas\SiteAdvisor\6066\SiteAdv.dll

O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [Motive SmartBridge] "C:\ARQUIV~1\ASSIST~1\SMARTB~1\MotiveSB.exe" /restart

O4 - HKLM\..\Run: [Network Security] C:\WINDOWS\System32\NSecurity.exe

O4 - HKLM\..\Run: [CaAvTray] "C:\Arquivos de programas\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe"

O4 - HKLM\..\Run: [CAVRID] "C:\Arquivos de programas\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe"

O4 - HKLM\..\Run: [Office Monitor Secure Systema] C:\WINDOWS\System32\absecure32.exe

O4 - HKLM\..\Run: [siteAdvisor] C:\Arquivos de programas\SiteAdvisor\6066\SiteAdv.exe

O4 - HKLM\..\Run: [Client Server Runtime Process System] NSecurity.exe

O4 - HKLM\..\RunServices: [Client Server Runtime Process System] NSecurity.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe

O4 - HKCU\..\Run: [Network Security] C:\WINDOWS\System32\NSecurity.exe

O4 - HKCU\..\Run: [Office Monitor Secure Systema] C:\WINDOWS\System32\absecure32.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Arquivos de programas\Adobe\Reader 8.0\Reader\reader_sl.exe

O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Arquivos de programas\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe

O4 - Global Startup: Assistente Tecnico Speedy.lnk = C:\Arquivos de programas\Assistente Tecnico Speedy\bin\matcli.exe

O8 - Extra context menu item: &Download by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/201

O8 - Extra context menu item: &Grab video by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/204

O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/203

O8 - Extra context menu item: Down&load all by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/202

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\MSMSGS.EXE

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\MSMSGS.EXE

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.cyberlink.com/winxp/CheckDVD.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1179794187781

O17 - HKLM\System\CCS\Services\Tcpip\..\{11555F0C-7557-4CB2-953C-CAACC17AB733}: NameServer = 200.204.0.10 200.204.0.138

O17 - HKLM\System\CS1\Services\Tcpip\..\{11555F0C-7557-4CB2-953C-CAACC17AB733}: NameServer = 200.204.0.10 200.204.0.138

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Arquivos de programas\SiteAdvisor\6066\SiteAdv.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O23 - Service: antivirusdll - Unknown owner - C:\WINDOWS\msnmessangern.exe

O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Arquivos de programas\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Arquivos de programas\SiteAdvisor\6066\SAService.exe

O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Arquivos de programas\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe

jgarcia · Maio 30, 2007

Opa Nilson N,

1. Baixe o BankerFix.

2. Desative o seu anti-vírus temporariamente.

3. Dê um duplo-clique sobre o bankerfix.exe. Uma mensagem aparecerá avisando que o mesmo será baixado via internet. Clique em Ok -> Ok. Aperte Enter e aguarde o término do scan.

4. Terminado o scan, leia a mensagem na tela e aperte Enter novamente.

5. Habilite o seu anti-vírus.

6. Retorne com um novo log do HijackThis, juntamente com o relatorio.txt do BankerFix (ele estará em C:\LinhaDefensiva\).

7. Depois de postar a sua resposta você poderá deletar a pasta LinhaDefensiva contida no C.

Abraços.

Nilson N · Maio 31, 2007

Logfile of HijackThis v1.99.1

Scan saved at 22:54:24, on 30/5/2007

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\msnmessangern.exe

C:\Arquivos de programas\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe

C:\Arquivos de programas\SiteAdvisor\6066\SAService.exe

C:\ARQUIV~1\ASSIST~1\SMARTB~1\MotiveSB.exe

C:\Arquivos de programas\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe

C:\Arquivos de programas\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\NSecurity.exe

C:\Arquivos de programas\UPHClean\uphclean.exe

C:\Arquivos de programas\SiteAdvisor\6066\SiteAdv.exe

C:\WINDOWS\System32\ctfmon.exe

C:\WINDOWS\System32\absecure32.exe

C:\Arquivos de programas\Assistente Tecnico Speedy\bin\mpbtn.exe

C:\WINDOWS\System32\WgaTray.exe

C:\WINDOWS\System32\wuauclt.exe

C:\Arquivos de programas\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe

C:\Arquivos de programas\EasyPHP1-8\EasyPHP.exe

C:\ARQUIV~1\EASYPH~1\Apache\apache.exe

C:\ARQUIV~1\EASYPH~1\MySql\bin\mysqld.exe

C:\ARQUIV~1\EASYPH~1\Apache\apache.exe

C:\Arquivos de programas\Orbitdownloader\orbitdm.exe

C:\Arquivos de programas\Orbitdownloader\orbitnet.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\NOTEPAD.EXE