[Arquivado]INFECTADO - spybot, avg, avast não abrem

tiagosca · Julho 9, 2007

Olá a todos, esperam que possam me ajudar.

Fazendo downloads pelo emule, baixei um arquivo suspeito e acidentalmente abri. :ermm: Sempre tenho atenção em relação a isso, em não abrir arquivos com extensões desconhecidas, mas desta vez bobiei.

Bem, desde então não consigo executar o avg, o avast, spybot ... mesmo desinstalando e reinstalando, o "exe" destes programas "somem". Instalei o ad-ware mas no meio do caminho de procura ele dá erro.

VIRUSTOTAL ..

scaneando no virustotal.com o arquivo que baixei, deu esse resultado:

Antivirus Result

AhnLab-V3 ------

AntiVir TR/Crypt.CFI.Gen

Authentium ------

Avast ------

AVG Downloader.Generic5.AO

BitDefender Win32.Worm.Bagle.ZIU

CAT-QuickHeal (Suspicious) - DNAScan

ClamAV ------

DrWeb ------

eSafe suspicious Trojan/Worm

eTrust-Vet Win32/Glieder.FR

Ewido ------

FileAdvisor ------

Fortinet W32/Bagle.CA!tr.dldr

F-Prot ------

Ikarus Trojan-Downloader.Win32.Bagle.ca

Kaspersky Trojan-Downloader.Win32.Bagle.ca

McAfee New Malware.bl

Microsoft ------

NOD32v2 ------

Norman ------

Panda Suspicious file

Sophos ------

Sunbelt VIPRE.Suspicious

Symantec ------

TheHacker ------

VBA32 ------

VirusBuster ------

Webwasher-Gateway Trojan.Crypt.CFI.Gen

Ou seja, imagino que meu micro esteja infectado com toda essa porcaria ae.

Executei também o HIJACKTHIS, com o seguinte resultado:

Logfile of HijackThis v1.99.1

Scan saved at 04:33:29, on 9/7/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Rscmpt.exe

C:\WINDOWS\Mixer.exe

C:\Arquivos de programas\Java\jre1.5.0_11\bin\jusched.exe

C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Microsoft Money\System\reminder.exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

C:\Arquivos de programas\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\cmpe.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqSTE08.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\WISPTIS.EXE

C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\AcroRd32.exe

C:\Arquivos de programas\Enigma Software Group\SpyHunter\SpyHunter.exe

C:\Documents and Settings\admin\Meus documentos\programas\SEGURANÇA - VIRUS ETC\anti spyware\hijack\hjc\hjc.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uol.com.br/

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\abc\eft\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.5.0_11\bin\ssv.dll

O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\WINDOWS\Downloaded Program Files\gbieh.dll

O2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\WINDOWS\Downloaded Program Files\gbiehCef.dll

O4 - HKLM\..\Run: [Rscmpt] C:\WINDOWS\system32\Rscmpt.exe

O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup

O4 - HKLM\..\Run: [suite de Aplicativos Gráfi2a] C:\Arquivos de programas\Corel\Corel Graphics 11\Register\registration.exe /title="Suite de Aplicativos Gráficos CorelDRAW 11" /date=030407 serial=DR11CRD-0012082-DGW

O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [mp3creator] C:\WINDOWS\asicutil2.exe "MP3 Creator" "mp3creator" 3

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.5.0_11\bin\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [HP Software Update] C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] C:\Arquivos de programas\Corel\Corel Graphics 12\Languages\BR\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=071407 serial=DR12WEX-1504397-KTY lang=BP

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [spyHunter] C:\Arquivos de programas\Enigma Software Group\SpyHunter\SpyHunter.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Reminder] C:\Arquivos de programas\Microsoft Money\System\reminder.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office\OSA9.EXE

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {D9CE2963-8547-4C18-A4CE-DA27278310D8} (Instalador Remoto UOL) - http://download.uol.com.br/discadorUOL/lig...tiveInstall.cab

O16 - DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} (GbpDistObj Class) - https://www14.bancobrasil.com.br/plugin/GbpDist.cab

O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399003} (GbPluginObj Class) - https://imagem.caixa.gov.br/cab/GbPluginCef.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{5046DDAA-00BB-49A1-986D-D30226F0E33E}: NameServer = 200.149.55.140 200.165.132.147

O17 - HKLM\System\CCS\Services\Tcpip\..\{8CBB448C-AFEA-44FA-A72A-51DCC6F8D825}: NameServer = 200.202.93.75,200.202.0.34

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\ARQUIV~1\MSNMES~1\msgrapp.dll" (file missing)

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\ARQUIV~1\ARQUIV~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Arquivos de programas\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe (file missing)

O23 - Service: avast! Antivirus - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe (file missing)

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: Context Manager Process Extension (cmpe) - LightComm - C:\WINDOWS\system32\cmpe.exe

O23 - Service: Gbp Service (GbpSv) - GAS Tecnologia LTDA - C:\Arquivos de programas\GbPlugin\GbpSv.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O que posso fazer? alguma opção que não seja formatar?

Espero que alguem possa me ajudar.,.. um abraço

Ps.: não consigo iniciar no modo seguro

ps2.: estou passando o spyhunter que até então não encontrou nada .

jgarcia · Julho 9, 2007

Opa tiagosca,

Siga as instruções deste tutorial e retorne com o resultado.

Abraços.

tiagosca · Julho 10, 2007

oi jgarcia ! muito obrigado pela ajuda !

seguindo sua indicação - e de mais outra pessoa de outro forum - fiz o seguinte:

passei primeiro o EliBagla, que permitiu que eu entrasse em modo seguro, onde então passei o EliStarA , o EliTriIP e o Clean.

Consegui então reinstalar o spybot e o avast.

Seguem os relatórios:

INFOSAT

Mon Jul 09 08:32:44 2007

----------------------------------------------

Lista de Acciones (por Acción Directa):

C:\DOCUMENTS AND SETTINGS\ADMIN\DADOS DE APLICATIVOS\HIDIRES\HIDR.EXE --> Eliminado Bagle

C:\DOCUMENTS AND SETTINGS\ADMIN\DADOS DE APLICATIVOS\HIDIRES\ROSA.SYS --> Eliminado Bagle (rootkit)

C:\WINDOWS\SYSTEM32\HLDRRR.EXE --> Bagle.dldr Renombrado a .VIR

Eliminada Carpeta "%WinDir%\exefld"

Mon Jul 09 08:37:08 2007

----------------------------------------------

Lista de Acciones (por Acción Directa):

Restaurada Clave: "SafeBoot\Minimal y Network"

Mon Jul 09 08:37:58 2007

----------------------------------------------

Lista de Acciones (por Exploración):

Explorando Unidad C:\

C:\Arquivos de programas\eMule\Incoming\BLUE MAN GROUP SCREEN SAVER 1.0.ZIP --> Eliminado Bagle.dldr

C:\Arquivos de programas\eMule\Incoming\Blue Man Group Screen Saver 1.0\BLUE MAN GROUP SCREEN SAVER 1.0.EXE --> Eliminado Bagle.dldr

C:\WINDOWS\system32\FLEC003.EXE --> Eliminado Bagle.dldr

Mon Jul 09 09:01:40 2007

----------------------------------------------

Lista de Acciones (por Acción Directa):

C:\WINDOWS\SYSTEM32\HLDRRR.EXE.VIR --> Eliminado

Eliminada Carpeta "%AppData%\Hidires"

Mon Jul 09 09:01:43 2007

----------------------------------------------

Lista de Acciones (por Exploración):

Explorando Unidad C:\

Exploración Detenida por el Usuario.

Mon Jul 09 09:10:14 2007

--------------------------------------------------

Lista de Acciones (por Acción Directa):

Eliminado Servicio, "GbpSv"

Eliminada Clave "HKLM\...\Image File Execution Options\Your Image File Name Here without a path"

Eliminadas las Paginas de Inicio y de Busqueda del IE

Eliminados Ficheros Temporales del IE

Mon Jul 09 09:14:31 2007

--------------------------------------------------

Lista de Acciones (por Exploración):

Explorando Unidad C:\

C:\WINDOWS\system32\spool\drivers\w32x86\3\HPZ3A05 4.DLL --> Eliminado, MoviePass

C:\WINDOWS\system32\spool\drivers\w32x86\hpphotosm art_c3100_s4080\HPZ3A054.DLL --> Eliminado, MoviePass

Mon Jul 09 09:26:11 2007

---------------------------------------------

Lista de Acciones (por Acción Directa):

Mon Jul 09 09:26:22 2007

---------------------------------------------

Lista de Acciones (por Exploración):

Explorando Unidad C:\

C:\Arquivos de programas\HP\Digital Imaging\{BDBE2F3E-42DB-4d4a-8CB1-19BA765DBC6C}\autorun.inf --> Eliminado, BackDoor.CMQ (inf)

C:\Arquivos de programas\HP\Temp\{BDBE2F3E-42DB-4d4a-8CB1-19BA765DBC6C}\autorun.inf --> Eliminado, BackDoor.CMQ (inf)

CLEAN

Script executed in Safe Mode

Rapport clean par Malekal_morte - http://www.malekal.com

Script executed in Safe Mode seg 09/07/2007 a 9:31:03,54

Microsoft Windows XP [versÆo 5.1.2600]

*** Suppression C:

*** Suppression C:\WINDOWS\

*** Suppression C:\WINDOWS\system32

tentative de suppression de C:\WINDOWS\system32\SpoonUninstall.exe

*** Suppression C:\Arquivos de programas

*** Deletion of the registry keys successful..

*** End of the report !

HIJACKTHIS

Logfile of HijackThis v1.99.1

Scan saved at 23:58:57, on 9/7/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\Rscmpt.exe

C:\WINDOWS\Mixer.exe

C:\Arquivos de programas\Java\jre1.5.0_11\bin\jusched.exe

C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Microsoft Money\System\reminder.exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqSTE08.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\cmpe.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wdfmgr.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\System32\alg.exe

C:\Arquivos de programas\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe

C:\Arquivos de programas\Outlook Express\msimn.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\Arquivos de programas\MSN Messenger\msnmsgr.exe

C:\Documents and Settings\admin\Meus documentos\programas\SEGURANÇA - VIRUS ETC\anti spyware\hijack\hjc\hjc.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uol.com.br/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll