[Resolvido] "Erro de certificado" seria virus?

[Igor_Filipe 0]

Ola,

 

Quando entro em paginas como orkut, hotmail e gmail aparece q esta dando erro de certificado...

 

 

"Há um problema no certificado de segurança do site.

 

 

O certificado de segurança apresentado pelo site expirou ou ainda não é válido.

 

Problemas de certificado de segurança podem indicar uma tentativa de enganá-lo ou de interceptar algum dado enviado ao servidor.

Recomendamos fechar a página da Web e não continuar no site.

Clique aqui para fechar esta página da Web.

Continuar neste site (não recomendado)."

 

 

Será q isto seria algum malware?

 

meu log:

 

Logfile of HijackThis v1.99.1

Scan saved at 13:40:00, on 27/1/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0011)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\GbPlugin\GbpSv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Velox\Manager\desp2k.exe

C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe

C:\Arquivos de programas\DAEMON Tools\daemon.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe

C:\ARQUIV~1\Grisoft\AVG7\avgemc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\ARQUIV~1\Grisoft\AVG7\avgfwsrv.exe

D:\Lixo\Igor\Programas\iMasters\hijackthis\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Arquivos de programas\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: G-Buster Browser Defense ABN AMRO - {C41A1C0E-EA6C-11D4-B1B8-444553540007} - C:\Arquivos de programas\GbPlugin\gbiehabn.dll

O4 - HKLM\..\Run: [desp2k] C:\Arquivos de programas\Velox\Manager\desp2k.exe

O4 - HKLM\..\Run: [AVG7_CC] C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [DAEMON Tools] "C:\Arquivos de programas\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [iSUSPM Startup] "C:\Arquivos de programas\Arquivos comuns\InstallShield\UpdateService\ISUSPM.exe" -startup

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Arquivos de programas\Arquivos comuns\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [CloneDVDElbyDelay] "C:\Arquivos de programas\Elaborate Bytes\CloneDVD\ElbyCheck.exe" /L ElbyDelay

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll

O11 - Options group: [iNTERNATIONAL] International*

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.2.100.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/PT-BR/a-UNO1/GAME_UNO1.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399007} (GbPluginObj Class) - https://wwws.realsecureweb.com.br/mpr/plugi...GbPluginABN.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{800807C8-E126-43D0-B001-0E987C6E59B7}: NameServer = 200.165.132.155 200.149.55.142

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Arquivos de programas\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgemc.exe

O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgfwsrv.exe

O23 - Service: Gbp Service (GbpSv) - Unknown owner - C:\Arquivos de programas\GbPlugin\GbpSv.exe

O23 - Service: Macromedia Licensing Service - Macromedia - C:\Arquivos de programas\Arquivos comuns\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe (file missing)

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

[jgarcia 1]

Opa Igor_Filipe,

 

Baixe o ComboFix em:

ComboFix

 

1) Dê um duplo-clique no combofix.exe e tecle "Y" para prosseguir. O processo vai durar, em média, 10 minutos;

2) O ComboFix reiniciará o PC automaticamente, a fim de que o processo de remoção seja finalizado (somente se houver infecção);

3) Quando a varredura acabar, será gerado um log, que estará em C:\ComboFix.txt;

4) Não clique na janela do ComboFix, nem feche clicando no X, enquanto a ferramenta estiver sendo executada, pois isto implicará na desconfiguração de seu desktop (ele ficará todo branco);

5) Para parar ou sair do ComboFix, tecle "N";

6) Preciso que você cole o conteúdo do ComboFix.txt em sua próxima resposta.

 

Abraços.

[Igor_Filipe 0]

Opa Jgarcia,

 

Ai esta o log.

 

 

 

ComboFix 07-08-03.2 - "Igor Felipe" 2007-08-02 19:56:02.1 [GMT -3:00] - NTFS

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.Verdadeiro

* Created a new restore point

 

 

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

 

 

-------\WINIO

 

 

((((((((((((((((((((((((( Files Created from 2007-07-02 to 2007-08-02 )))))))))))))))))))))))))))))))

 

 

2007-08-02 19:55 51,200 --a------ C:\WINDOWS\nircmd.exe

2007-07-24 01:58 5,120 --a------ C:\WINDOWS\system32\ff_vfw.dll

2007-07-24 01:58 <DIR> d-------- C:\Arquivos de programas\ffdshow

2007-07-24 01:52 49,152 --a------ C:\WINDOWS\system32\ChCfg.exe

2007-07-24 01:51 577,536 --a------ C:\WINDOWS\soundman.exe

2007-07-24 01:51 4,030,144 --a------ C:\WINDOWS\system32\drivers\alcxwdm.sys

2007-07-24 01:51 315,392 --a------ C:\WINDOWS\alcupd.exe

2007-07-24 01:51 217,088 --a------ C:\WINDOWS\Alcrmv.exe

2007-07-24 01:51 147,456 --a------ C:\WINDOWS\system32\RtlCPAPI.dll

2007-07-24 01:51 10,528,768 --a------ C:\WINDOWS\system32\RTLCPL.exe

2007-07-24 01:51 <DIR> d-------- C:\Arquivos de programas\Realtek AC97

2007-07-19 16:25 <DIR> d-------- C:\Arquivos de programas\TibiaBR Interaction

2007-07-19 16:01 <DIR> d-------- C:\DOCUME~1\IGORFE~1\DADOSD~1\fretsonfire

2007-07-19 16:01 <DIR> d-------- C:\Arquivos de programas\Frets on Fire

2007-07-17 00:18 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\nView_Profiles

2007-07-17 00:16 180,224 --a------ C:\WINDOWS\system32\nvudisp.exe

2007-07-17 00:16 <DIR> d-------- C:\WINDOWS\nview

2007-07-17 00:15 180,224 --a------ C:\WINDOWS\system32\NVUNINST.EXE

2007-07-15 16:47 <DIR> d-------- C:\WINDOWS\system32\Tradu‡Æo San Andreas - Grupo GTSA

2007-07-15 14:07 <DIR> d-------- C:\Arquivos de programas\Rockstar Games

2007-07-13 17:09 <DIR> d-------- C:\DOCUME~1\IGORFE~1\DADOSD~1\Tibia

2007-07-13 16:13 <DIR> d-------- C:\Arquivos de programas\Tibia

2007-07-11 23:54 <DIR> d-------- C:\Arquivos de programas\Asprate

2007-07-03 13:23 <DIR> d-------- C:\Arquivos de programas\Advanced MP3 Converter

 

 

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

 

2007-08-02 15:53 --------- d-------- C:\Arquivos de programas\Tales of Pirates Online

2007-07-22 22:18 --------- d-------- C:\DOCUME~1\IGORFE~1\DADOSD~1\Screenshot Sender

2007-07-22 00:05 --------- d-------- C:\Arquivos de programas\WC3Banlist

2007-07-11 03:19 --------- d-------- C:\DOCUME~1\IGORFE~1\DADOSD~1\Hamachi

2007-07-05 20:09 --------- d-------- C:\Arquivos de programas\Eidos Interactive

2007-07-04 00:10 --------- d-------- C:\DOCUME~1\IGORFE~1\DADOSD~1\teamspeak2

2007-07-01 16:02 --------- d-------- C:\Arquivos de programas\Arquivos comuns\DirectX

2007-07-01 15:59 108144 --a------ C:\WINDOWS\system32\CmdLineExt.dll

2007-06-27 11:59 67450 --a------ C:\WINDOWS\system32\perfc016.dat

2007-06-27 11:59 425426 --a------ C:\WINDOWS\system32\perfh016.dat

2007-06-23 15:03 --------- d-------- C:\Arquivos de programas\Teamspeak2_RC2

2007-06-15 16:52 --------- d-------- C:\Arquivos de programas\Lavasoft

2007-06-15 16:51 --------- d-------- C:\Arquivos de programas\Arquivos comuns\Wise Installation Wizard

2007-06-14 20:03 --------- d-------- C:\Arquivos de programas\YoutubeEXE

2007-06-08 10:59 --------- d-------- C:\Arquivos de programas\XeFlashPlayer

2007-06-08 08:22 --------- d-------- C:\Arquivos de programas\Windows Live

2007-06-08 08:22 --------- d-------- C:\Arquivos de programas\MSN Messenger

2007-06-08 08:22 --------- d-------- C:\Arquivos de programas\Messenger Plus! Live

2007-06-07 12:49 --------- d-------- C:\Arquivos de programas\Arquivos comuns\Macromedia Shared

2007-06-04 20:42 --------- d-------- C:\Arquivos de programas\DVD Decrypter

2007-06-04 15:18 9344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys

2007-06-04 15:17 8320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys

2007-06-04 15:14 6272 --a------ C:\WINDOWS\system32\drivers\AWRTPD.sys

2007-05-28 21:34 56 -r-hs---- C:\WINDOWS\system32\1E52ECD4BD.sys

2007-05-28 21:34 3350 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys

2007-05-26 22:43 95466 --a------ C:\WINDOWS\War3Unin.dat

2004-10-01 14:00 40960 --a------ C:\Arquivos de programas\Uninstall_CDS.exe

 

 

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

 

 

*Note* empty entries & legit default entries are not shown

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"desp2k"="C:\Arquivos de programas\Velox\Manager\desp2k.exe" [2006-08-03 15:05]

"AVG7_CC"="C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe" [2007-04-19 20:51]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]

"DAEMON Tools"="C:\Arquivos de programas\DAEMON Tools\daemon.exe" [2006-11-12 07:48]

"Emurayden PSX Emulator"="" []

"ISUSPM Startup"="C:\Arquivos de programas\Arquivos comuns\InstallShield\UpdateService\ISUSPM.exe" [2005-08-11 16:30]

"ISUSScheduler"="C:\Arquivos de programas\Arquivos comuns\InstallShield\UpdateService\issch.exe" [2005-08-11 16:30]

"CloneDVDElbyDelay"="C:\Arquivos de programas\Elaborate Bytes\CloneDVD\ElbyCheck.exe" [2002-11-02 03:33]

"nwiz"="nwiz.exe" [2006-03-09 15:29 C:\WINDOWS\system32\nwiz.exe]

"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-03-09 15:29]

"SoundMan"="SOUNDMAN.EXE" [2007-04-16 15:28 C:\WINDOWS\soundman.exe]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-03-09 15:29]

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:45]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{E37CB5F0-51F5-4395-A808-5FA49E399007}"= C:\Arquivos de programas\GbPlugin\gbiehabn.dll [2007-07-23 22:39 339376]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\K-Lite Nitro BETA]

C:\Arquivos de programas\K-LiteNitro\K-LiteNitro.exe /hide

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

%systemroot%\system32\dumprep 0 -k

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]

RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"ose"=3 (0x3)

 

R0 Imagedrv;Imagedrv;C:\WINDOWS\system32\DRIVERS\imagedrv.sys

R2 GbpSv;Gbp Service;C:\Arquivos de programas\GbPlugin\GbpSv.exe

R3 ElbyDelay;ElbyDelay;C:\WINDOWS\system32\Drivers\ElbyDelay.sys

R3 nm;Driver de monitor de rede;C:\WINDOWS\system32\DRIVERS\NMnt.sys

R3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys

R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);C:\WINDOWS\system32\DRIVERS\RMSPPPOE.SYS

R3 rtl8029;Realtek RTL8029(AS)-based PCI Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\RTL8029.SYS

S3 mcdbus;Driver for MagicISO SCSI Host Controller;C:\WINDOWS\system32\DRIVERS\mcdbus.sys

S3 usbsermpt;Motorola USB Modem Driver for MPT;C:\WINDOWS\system32\DRIVERS\usbsermpt.sys

 

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ded16f50-ae25-11db-a157-00304f0ecb8f}]

AutoRun\command- G:\Autorun.exe

 

 

**************************************************************************

 

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-08-02 19:59:35

Windows 5.1.2600 Service Pack 2 NTFS

 

scanning hidden processes ...

 

scanning hidden registry entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

 

Completion time: 2007-08-02 20:00:59 - machine was rebooted

C:\ComboFix-quarantined-files.txt ... 2007-08-02 20:00

 

--- E O F ---

[jgarcia 1]

Opa Igor_Filipe,

 

Não há entradas anormais em seus logs.

 

Abraços.

[Shine 0]

PROBLEMA RESOLVIDO!

 

Caso o autor necessite que o tópico seja reaberto é preciso enviar uma Mensagem Privada para um Moderador com um link para o tópico.